BUG: User in legal group and with staff status is effectively a superuser

[ghsa-retrieval]

Describe the bug
Users that are assigned to the "Legal" group and have Staff Status enable, currently posses the following permissions among others, as documented by the permission matrix:

• Change dataspace
• Add users
• Change users

This appears to have unintended or at least unexpected consequences from the perspective of DejaCode users. Users with the permissions as described above can perform the following actions:

• Increase their privilege by making themselves a superuser
• Remove permissions from higher privileged accounts such as superusers
• Deactivating higher privileged users such as superusers

As such assigning a user to the "Legal" group and giving them Staff Status is effectively the equivalent of making them a superuser.

To Reproduce

1. Create a user
2. Assign them to the "Legal" group
3. Enable Staff Status
4. Log in as the user you have created
5. Check that you can escalate your own privileges and edit superusers

Expected behavior

• Users should not be able to give themselves higher permissions
• Users should not be able to edit user accounts that have higher permissions than themselves
• It is questionable that the "Legal" group needs to manage the dataspace and users at all, as this is an administrative task

Screenshots
n.a.

Context (OS, Browser, Device, etc.):
n.a.