Add endpoint for getting disabled user list

[come-nc]

• Resolves: #

Summary

Adds an endpoint to get the list of disabled users, with offset and limit.
This avoids fetching all the users when opening the disabled user list, fixing the disabled user list for LDAP backed installations which do not have a lot of disabled users. Also avoids spamming the LDAP server when opening disabled user list.

TODO

• Use the new endpoint to show the disabled user list efficiently enh(settings): Load from disabled users endpoint #40169

Checklist

• Code is properly formatted
• Sign-off message is added to all commits
• Tests (unit, integration, api and/or acceptance) are included
• Screenshots before/after for front-end changes
• Documentation (manuals or wiki) has been updated or is not required
• Backports requested where applicable (ex: critical bugfixes)

[provokateurin]

There is a new CI workflow that checks that the OpenAPI specs are up-to-date. Please rebase onto master and regenerate the specs so that the workflow can do it's job.

[provokateurin]

API LGTM

[nfebe]

A default value for limit seems reasonable of if null, we should check for valid values different from zero... Such as negative numbers and 0

    if ($limit !== null && $limit < 0) {
    // Whatever exception
        throw new InvalidArgumentException("Invalid limit value: $limit");
    }

    if ($offset < 0) {
        throw new InvalidArgumentException("Invalid offset value: $offset");
    }

Generally, this is a little slim or error handling.

[come-nc]

A default value for limit seems reasonable of if null, we should check for valid values different from zero... Such as negative numbers and 0

    if ($limit !== null && $limit < 0) {
    // Whatever exception
        throw new InvalidArgumentException("Invalid limit value: $limit");
    }

    if ($offset < 0) {
        throw new InvalidArgumentException("Invalid offset value: $offset");
    }

Generally, this is a little slim or error handling.

Nice input, I’ve added that to the controller method.
For the internal method I consider the caller knows what he’s doing, but for the controller it makes sense to block invalid values.