fix bug stopping editing of permissions of webauthn platform admins

We hide the radio field in the HTML for platform admins, as we don't
want anyone to be able to change their auth type. However, when the form
is validated, the form has a field called login_authentication that it
expects a value for. It silently fails as it complains that when the
user POSTed they didn't select a value for that radio field, but the
error message is on the radio fields that don't get displayed to the
user so they'd never know.

Fixing this is actually pretty hard.

We use this form in two places, one where we have a user to edit, one
where we are creating an invite from scratch. So sometimes we don't know
about a user's auth type. In addition, radio buttons are mandatory by
design, but now sometimes we don't just want to make it optional but
explicitly ignore the value being passed in? To solve this, remove the
field entirely from the form if the user is a platform admin. This means
that if the code in manage_users.py tries to access the
login_authentication value from the form, it'll error, but I think
that's okay to leave for now given we concede that this isn't a perfect
final solution.

The tests didn't flag this previously as they tried to set from sms_auth
(the default for `platform_admin_user`) TO email_auth or sms_auth. Also,
the diagnosis of this bug was confounded further by the fact that
`mock_get_users_by_service` sets what is returned by the API - the
service model then takes the IDs out of that response and calls
`User.get_user_by_id` for the matching ID (as in, the code only uses
get_users_by_service to ensure the user belongs to that service). This
means that we accidentally set the form editing the current user, as
when we log in we set `get_user_by_id` to return the user of our choice

app/main/forms.py

@@ -1001,7 +1001,7 @@ class BasePermissionsForm(StripWhitespaceForm):
 
     @classmethod
     def from_user(cls, user, service_id, **kwargs):
-        return cls(
+        form = cls(
             **kwargs,
             **{
                 "permissions_field": [
@@ -1009,6 +1009,16 @@ class BasePermissionsForm(StripWhitespaceForm):
             },
             login_authentication=user.auth_type
         )
+        # if the user is a platform admin then we don't allow you to change the login type. Unfortunately, since the
+        # login_authentication field is a radio field, the validation expects it to have a value, and the choices in it
+        # normally don't allow 'webauthn_auth'.
+        # If the user has webauthn_auth too, then we'll try and validate against that. We should never be changing
+        # auth of platform admin users, so just force the choices to be this.
+        # TODO: if the user is a regular user with webauthn_auth we will still show the radios, so if you edit that
+        # user's regular permissions you'll necessarily change their auth type as the value will be in the POST
+        if user.platform_admin:
+            del form.login_authentication
+        return form
 
 
 class PermissionsForm(BasePermissionsForm):