snipe-it: Admin privilege escalation via UsersController store()

The store() method in UsersController (web and API) does not strip admin permission when creating a user, allowing escalation to admin privileges.

Any authenticated user with the users.create permission, such as HR staff or department leads.

Apply the patch aea3877718 to prevent privilege escalation.