Remove user permissions if service becomes a broadcast service

The "normal" service permissions and broadcast service permissions are
going to be different with no overlap. This means that if you were
viewing the team members page, there might be permissions in the
database that are not visible on the frontend if a service has changed
type. For example, someone could have the 'manage_api_keys' permission,
which would not show up on the team members page of a broadcast service.
To avoid people having permissions which aren't visible in admin, we now
remove all permissions from users when their service is converted to a
broadcast service.

Permisions for invited users are also removed.

It's not possible to convert a broadcast service to a normal service, so
we don't need to cover for this scenario.

tests/app/service/test_rest.py

@@ -4128,3 +4128,43 @@ def test_set_as_broadcast_service_updates_services_history(
 
     new_history_records = Service.get_history_model().query.filter_by(id=sample_service.id).all()
     assert len(new_history_records) == len(old_history_records) + 1
+
+
+def test_set_as_broadcast_service_removes_user_permissions(
+    admin_request,
+    broadcast_organisation,
+    sample_service,
+    sample_service_full_permissions,
+    sample_invited_user,
+):
+    service_user = sample_service.users[0]
+
+    # make the user a member of a second service
+    dao_add_user_to_service(
+        sample_service_full_permissions,
+        service_user,
+        permissions=[
+            Permission(service_id=sample_service_full_permissions.id,
+                       user_id=service_user.id,
+                       permission='send_emails')
+        ]
+    )
+    assert len(service_user.get_permissions(service_id=sample_service.id)) == 8
+    assert len(sample_invited_user.get_permissions()) == 3
+
+    admin_request.post(
+        'service.set_as_broadcast_service',
+        service_id=sample_service.id,
+        _data={
+            'broadcast_channel': 'test',
+            'service_mode': 'live',
+            'provider_restriction': 'ee'
+        }
+    )
+
+    # The user permissions for the broadcast service get removed
+    assert len(service_user.get_permissions(service_id=sample_service.id)) == 0
+    # Permissions for users invited to the broadcast service get removed
+    assert sample_invited_user.permissions == ''
+    # Permissions for other services remain
+    assert len(service_user.get_permissions(service_id=sample_service_full_permissions.id)) == 1