Authenticated user enumeration via missing elevation check

Incorrect access control in Jellyfin before 10.8 allows remote authenticated users to list all server users and identify administrators. UserController's GetUsers endpoint checks ordinary user authorization rather than administrator elevation and returns every user's ID and policy. Any account can therefore enumerate private user records and identify administrator accounts, but this endpoint alone does not grant administrator privileges.