Closes #16137: Remove is_staff boolean from User model

[jeremystretch]

Closes: #16137

• Remove the is_staff boolean field from our custom User model
• Remove the REMOTE_AUTH_STAFF_GROUPS and REMOTE_AUTH_STAFF_USERS configuration parameters
• Introduced the IsSuperuser REST API permission to replace DRF's IsAdminUser (which evaluates is_staff)
• Accessing UI & REST API views for RQ tasks now requires superuser permission
• Accessing the installed plugins API view now requires superuser permission
• Extend the RQ tasks view tests to check permissions enforcement consistently
• RemoteUserBackend now infers is_staff from is_superuser
• PluginMenuItem still supports the staff_only attribute, but it now maps to the is_superuser attribute on a user
• Remove references to is_staff from the LDAP authentication docs

[jnovinger]

Had one question about why were still setting user.is_staff in RemoteUserAuth, but this looks good otherwise.

[jnovinger]

Hopefully it's just my lack of familiarity with our use of RemoteUserBackend, but I don't understand why we need to do this (temporarily setting user.is_staff) here, now.

[jeremystretch]

Honestly I'm not sure that we do, but I figured it might be less disruptive to keep it. That said, I'm okay removing it for v4.5.

[jnovinger]

I'm +0 on removing it. Happy to defer if you think it's best to leave it, but otherwise it's just one more thing for us to remember to get back to later.

Going to approve this PR and let you decide.