[DO NOT MERGE] 575 readonly user perms

@pld here you go
this is existing code, but let's refactor in this and the below `perms` assignment into a helper function, e.g.

```clojure
(shared-users+perms
  [project username]
  (let [shared-users (for [user (:users project)]
                      (merge api-user/profile account (:user user)) user)
    [shared-users (get-perms shared-user username)]))
```

and then here assign with destructing:
```clojure
...
[shared-users perms] (shared-users+perms project username)
...
```