Fix: check the right matching the model behavior (#664)

[stonebuzz]

Checklist before requesting a review

Please delete options that are not relevant.

• I have performed a self-review of my code.
• I have added tests (when available) that prove my fix is effective or that my feature works.
• I have updated the CHANGELOG with a short functional description of the fix or new feature.
• This change requires a documentation update.

Description

Backport for #664

• A model allowed to update existing items was accepted as soon as the user held the creation right on the imported itemtypes, so an import could rewrite items the profile is not allowed to modify.
• The required right is now derived from what the model is actually allowed to do: creation right for a model that adds lines, update right for a model that updates lines, and the same right is verified again just before each write.
• Imported user passwords were written directly in the database, which skipped the configured password policy, left the password expiration date unchanged and logged nothing in the item history.
• Passwords are now set through the standard user update, so the policy, the expiration date and the history all apply.

Screenshots (if appropriate):