Authenticated account deactivation via unchecked user updates

Improper authorization in the ZenML user update API before 0.56.2 allows remote authenticated users to deactivate other accounts. The PUT /api/v1/users/{user_name_or_id} handler accepted another account's identifier and applied its active field without requiring administrator status. Any authenticated account could therefore deactivate an administrator account, interrupting that account's access and potentially disrupting management operations.