Whenever we already deal with a User object, let's use the more specific
method avatar_icon_for_user.

fix issue #39843 Incorrect guidance stating blocked users will be removed from groups and projects as members

+ Add a partial for displaying user deletion guidance

and don't offer to impersonate them

- Add a `destroy_user` ability. This didn't exist before, and was implicit in
  other abilities (only admins could access the admin area, so only they could
  destroy all users; a user can only access their own account page, and so can
  destroy only themselves).

- Grant this ability to admins, and when the current user is trying to destroy
  themselves. Disallow destroying ghost users in all cases.

- Modify the `Users::DestroyService` to check this ability. Also check it in
  views to decide whether or not to show the "Delete User" button.

- Add a short summary of the Ghost User to the bio.

Closes https://gitlab.com/gitlab-org/gitlab-ce/issues/24036

The parameter is used to search users by several criretia was
called :name. This request renames it to :search_query which closer
to it actual perpose

This reverts commit bf2a86b7.

This reverts commit 68155ee7, reversing
changes made to 7ebd011e.

The issue was with the `User#groups` and `User#projects` associations
which goes through the `User#group_members` and `User#project_members`.

Initially I chose to use a secure approach by storing the requester's
user ID in `Member#created_by_id` instead of `Member#user_id` because I
was aware that there was a security risk since I didn't know the
codebase well enough.

Then during the review, we decided to change that and directly store the
requester's user ID into `Member#user_id` (for the sake of simplifying
the code I believe), meaning that every `group_members` / `project_members`
association would include the requesters by default...

My bad for not checking that all the `group_members` / `project_members`
associations and the ones that go through them (e.g. `Group#users` and
`Project#users`) were made safe with the `where(requested_at: nil)` /
`where(members: { requested_at: nil })` scopes.

Now they are all secure.

Signed-off-by: Rémy Coutable <remy@rymai.me>

This reverts commit 13e37a3e.