Authenticated privilege escalation via unchecked self-role update

Improper access control in Doorman 0.1.0 and 1.0.2 allows remote authenticated users to gain non-admin privileged roles via its user API. The update_user function accepts the role field from update_user_model.py at /platform/user/{username} without checking manage_users permission during self-updates. Any authenticated account can assign itself a higher non-admin role, gaining that role's access to sensitive data, configurations, and managed resources.