Fixed the issue of not being able to change "Comment access level".
The issue was that ACCESS_CONTROL_ATTRIBUTES didn't check the value of access_level_id.
Also added missing tests for users#access page (this marks first ever RSpec test that I've written).
Fixes https://squish.ish.com.au/tasks/17799