prevent non-admin users with SIS IDs from deleting themselves

(previously, canvas only did this for users with SIS IDs and
managed authentication. I do not see how the managed auth part
is relevant.)

test plan:
 - The Edit Settings page at /profile/settings should show the
   "Delete My Account" link only if
   * the user is an account or site administrator, or
   * the user has no SIS ID
 - the "Really delete" page (users/1/delete) should redirect
   back to the profile page with an error message for non-admins
   with SIS IDs
 - the Users API should return a 401 (Unauthorized) error if
   non-admins with SIS IDs try to delete themselves

fixes CNVS-14804

Change-Id: I93a003235204b0fbde226c76aaf8677f3a417f9d
Reviewed-on: https://gerrit.instructure.com/39789
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: James Williams  <jamesw@instructure.com>
QA-Review: Clare Strong <clare@instructure.com>
Product-Review: Hilary Scharton <hilary@instructure.com>