feat: First-come-first-serve self-serve PAM username reservation

[valpackett]

One extra feature request related to #1107: currently PAM/UNIX usernames can only be assigned by an administrator.

That's fine for serious organizations :) but for small, especially hobbyist community deployments like hackerspaces that don't have "full-time support staff", it would be a lot more convenient if users could just pick usernames for themselves from the account UI, as long as the username is unique (not occupied by anyone else so far) of course.

[sebadob]

I decided specifically against allowing that for several reasons, and it does not make much sense as well. From the docs:

Users are not allowed to choose their Linux username themselves. This must be done by a Rauthy admin to avoid users trying things like root, postgres or systemd, which would be very bad of course. An admin needs to configure access to hosts anyway, so there is no real drawback, that users cannot choose on their own. Maintaining a blacklist with all possibly problematic usernames across all distros and systems is actually impossible, as Rauthy cannot even know which names might already be special in some companies and situations.

[sebadob]

I decided explicitly against allowing that for several reasons, and it does not make much sense as well. From the docs:

Users are not allowed to choose their Linux username themselves. This must be done by a Rauthy admin to avoid users trying things like root, postgres or systemd, which would be very bad of course. An admin needs to configure access to hosts anyway, so there is no real drawback, that users cannot choose on their own. Maintaining a blacklist with all possibly problematic usernames across all distros and systems is actually impossible, as Rauthy cannot even know which names might already be special in some companies and situations.