feat(users): bulk lookup users by email

[cdriesler]

Description & motivation

• The invites flow reaches a point where it knows:
  • A collection of emails
  • Where it would like to invite them to
• The current lookup allows searching one query => many user matches, but not many queries => any matches

Changes:

• Adds usersByEmail query modeled after users query
• Extracts common logic to lookupUsersBaseQuery
• Adds tests for both lookups

[iainsproat]

@hasServerRole(role: SERVER_GUEST)
@hasScopes(scopes: ["users:read", "profile:read"])

Can you remind me what this does; do they need to be logged in to use this?

Is there a limit on the number of emails which can be passed in? (I see there's a limit of 100 on the results)

What is to stop someone dumping in a list of known or guessed email addresses to app.speckle.systems and using that to confirm whether they are users or not? With the status quo of a single look up, they might hit up against our (generous) rate limits (as a fairly weak source of friction against abuse), but does this make it easier to abuse the system?

Do we need some sort of lookup limit or rate limit?

[iainsproat]

Would like a clearer description in the PR of the security/confidentiality implications before we merge.