swarm-controller: revoke matrix admin from former operators

The operator admin sync now also takes homeserver admin away. It records
each user id it sends `make-user-admin` for in
`operator-matrix-admins.json` under the controller's state directory
(written to a temporary file and renamed over it; a missing file is an
empty set). On each pass, a recorded account that is no longer in
authelia's `admins` group but is still joined to `#admins:<server>` is
sent `!admin users force-leave-room <user> <admin room id>` as `@swarm`,
over the same `/_matrix` path the grant uses. Leaving that room is what
ends tuwunel admin.

It never revokes an admin it didn't grant, `@swarm`, tuwunel's server
user (`@conduit:<server>`), an agent's account (the store's
`hive-agent-*` cert roles, the same roster the agent account mint uses),
or anyone in the new `services.hyperhive.swarm.matrix.adminSync.ignoreUsers`
list. That list reaches the daemon as
`SWARM_CONTROLLER_MATRIX_ADMIN_SYNC_IGNORE_USERS`. It also never sends a
revoke that would leave `#admins` with no member besides `@swarm` and the
server user.

A revoke is sent at most once per account per controller process, like a
grant. A recorded account that is out of both the group and the room is
dropped from the file.

Closes #4799

swarm-controller/README.md

@@ -50,7 +50,8 @@ The swarm's control plane. The swarm UI and `swarmctl` are its clients.
   icons, the cross-repo issue report, and the UI's quick links.
 
 It reads its configuration once at startup, from the environment the nix module
-sets. The one file it persists is `webhook-secret` in its state directory.
+sets. It persists `webhook-secret` and `operator-matrix-admins.json` in its
+state directory.
 The job graph lives in memory; hive status and wanted state live in the swarm
 queue, so both survive a restart.