Make upgrade event hooks prone against wonky calls

player_spawn sometimes is called with an invalid userid?
Add smrpg_[upgrade]_adminflag convar

This lets server admins restrict upgrades to a certain admin flag.
Upgrades are hidden from the rpgmenu, if the player isn't allowed to use
them.
Close the admin menu if targeted player leaves

This makes sure, an admin doesn't modifies stuff of a new player joining
right after the leaving one by accident.