fix(auth): prevent users from gaining additional permissions

[Bohreromir]

Users were able to pose as any other user in trino queries.
Can be done by logging in as bob and executing

await fetch('/api/auth/update-user', {
  method: 'POST',
  headers: { 'content-type': 'application/json' },
  credentials: 'include',
  body: JSON.stringify({ username: 'alice' })
});

in the browser console.
The fix prevents the username to be changed

[github-actions]

Coverage Report

Status	Category	Percentage	Covered / Total
🔵	Lines	50.87%	2495 / 4904
🔵	Statements	57.03%	3712 / 6508
🔵	Functions	65.89%	1028 / 1560
🔵	Branches	43.02%	1299 / 3019

File Coverage

File	Stmts	Branches	Functions	Lines	Uncovered Lines
Changed Files
src/lib/server/auth.ts	56.52%	38.46%	16.66%	68.42%	7, 8, 9, 12, 63-83

Generated in workflow #1031 for commit 3bb6186 by the Vitest Coverage Report Action