Restrict privilege for the API user usecase

[mahalakshme]

Need:

The API user need to just activate the deactivated users. Providing 'EditUserConfiguration' will let them create admin users as well. Also we are doing password based authentication for API users which is not the most secure one. So good to restrict their access.

AC:

• Create a privilege named 'Activate user'
• It should have permission only to activate - not even to deactivate
• Only users with the above privilege and EditUserConfiguration privilege should be able to call /api/user/enable