clean up user "deletion"

fixes CNVS-1552

any time the UI/API tries to "delete" a user, it should only be trying
to remove it from some root account (the @domain_root_account if not
otherwise specified). if that root account was the last root account the
user was associated with, then the remnants of the user are fully
deleted, but only then. leave User#destroy as a short-cut to delete the
user from all their accounts at once, but should not be invoked directly
from any UI/API actions.

test-plan:

 PERMISSIONS

   being able to remove a user from an account entails being able to:

   - DELETE http://accounts-domain/users/:user
   - DELETE /accounts/:account/users/:user

   both should fail or succeed together

   * given
     - Sally who's an admin with the :manage_user_logins
       permission on one account (Account1) and a student on another
       account (Account2)
     - Bob who's a student on both accounts
     - Alice who's an admin on Account1 with greater permissions than
       Sally

   * Sally should:
     - see "Delete My Account" on her Account1 profile
     - not see "Delete My Account" on her Account2 profile
     - not see "Delete My Account" on Bob's Account1 profile
     - not see "Delete My Account" on Alice's Account1 profile
     - see "Delete from Account1" at /users/:sally
     - see "Delete from Account1" at /users/:bob
     - not see "Delete from Account2" at /users/:sally
     - not see "Delete from Account2" at /users/:bob
     - not see "Delete from Account1" at /users/:alice
     - be able to remove herself from Account1
     - be able to remove Bob from Account1
     - not be able to remove herself from Account2
     - not be able to remove Bob from Account2
     - not be able to remove Alice from Account1

   * given Sally's Account1 pseudonym has a SIS ID but her Account2
     pseudonym doesn't, Sally should:
     - no longer see "Delete My Account" on her Account1 profile
     - no longer see "Delete from Account1" at /users/:sally
     - still see "Delete from Account1" at /users/:bob
     - no longer be able to remove herself from Account1
     - still be able to remove Bob from Account1

 EFFECTS

 * as Sally, remove Bob from Account1 via
   DELETE http://account1-domain/users/:bob
   - Bob's pseudonyms, enrollments, etc. in Account1 should be removed
   - Bob's pseudonyms, enrollments, etc. in Account2 should be untouched

 * repeat using DELETE /accounts/:account1/users/:bob, with the same
   expectations

Change-Id: Ib7612f95d1c7e4cca36d8486950565ec096b4ab1
Reviewed-on: https://gerrit.instructure.com/41591
Tested-by: Jenkins <jenkins@instructure.com>
QA-Review: August Thornton <august@instructure.com>
Reviewed-by: Cody Cutrer <cody@instructure.com>
Product-Review: Jacob Fugal <jacob@instructure.com>