Allow only GET for User Resource and make all attributes read only

SEE: https://gitlab.hzdr.de/hub-terra/sms/backend/-/merge_requests/295#note_1361507

I think we should remove the UserList entry there as well. https://gitlab.hzdr.de/hub-terra/sms/backend/-/merge_requests/295#note_1361515