Administrator takeover via duplicate username overwrite

Privilege escalation in Grav before 1.8.0-beta.27 allows remote authenticated users with user-creation rights to take over an administrator account. UserObject::save derives a filesystem storage key from a new account's username and, before the fix, writes the account without checking whether that key already exists. User-creation permission is sufficient to replace an existing administrator's email and password, after which full administrative access is available.