Account takeover via unchecked password reset

Authorization bypass in Crawlab 0.6.3 and earlier allows remote authenticated users to reset arbitrary account passwords via the change-password endpoint. PostUserChangePassword in core/controllers/user_v2.go reads the target user ID from the URL, hashes the supplied password, and replaces that account record without checking that the caller owns the account or has the admin role. Any valid JWT is sufficient, and the exposed user listing endpoint provides target IDs, so low-privileged users can take over administrator accounts and then execute spider code across the Crawlab cluster.