Restrict access to admin / system accounts

In ArchivesSpace there is no protection for the primary (bootstrap)
admin account from other users who have been granted admin rights.
This is also applies to any system account, these can be edited via
direct access to the url (i.e. the public user at /users/3/edit).

Currently any user with admin rights is able to act as the admin user
(more or less anonymously without detailed log poking which may not be
conclusive), and any user with admin rights can edit the admin user
and reset the password which can be very inconvenient (at the least),
requiring a command line password reset to restore it.

To reflect its "special" status the admin account should only be
viewable and accessible by directly logging into it. Access is then
narrowed down to users who have been given the admin password, which
tightens the security of the system overall.

Tests included:

./build/run selenium:test -Dexample='User management'