Keep the Disabled bit synchronized between merged users

Disabling a user did not disable all of the users merged into them.
This caused users disabled users to apparently still appear via the web
UI in user searches, as their merged-in (non-disabled) users often still
matched the search.

Explicitly propagate Disabled updates on users down into their merged-in
equivalents.  Note that changes to sub-users do not propagate upward;
loading them takes explicit effort, changing them could be more
surpising action-at-a-distance, and introduces difficulties with dealing
with cycles.