SCIM: a suspended account's open sessions end, and no credential it holds still works (SCIM-52)

The push router records which account each subscription belongs to, and
a new Revoke event drops every subscription the account holds, so its
IMAP IDLE, JMAP event streams and WebSockets on this node end. Other
users' subscriptions to its shared mailboxes stay. Test 28 now checks an
open IDLE is ended, and that the account's password over HTTP and its
own API key, both already cached, are refused on the next request.

crates/scim/src/users.rs

@@ -691,6 +691,18 @@ pub async fn replace(
         external_id,
     );
     if active_change.is_some() {
+        // SCIM-52: sessions the account has open are ended
+        if !active {
+            let _ = ctx
+                .server
+                .inner
+                .ipc
+                .push_tx
+                .send(common::ipc::PushEvent::Revoke {
+                    account_id: id.document_id(),
+                })
+                .await;
+        }
         audit(
             ctx,
             if active {