Restrict impersonation to subjects with same or fewer roles than actor

[lukasgraf]

Impersonation should be restricted in a way where it's only allowed to impersonate target users that have the same or fewer global roles as the actor (the service key user doing the impersonating).

In other words: If the target user has one or more global roles that the user owning the service key doesn't have, impersonation shall be rejected.