Check max users on user creation

Summary

• fix: check max users on user creation

• test: role and user limits

Due to the fact that we don't use two stage commit for ACL, we have to check all the ACL preconditions both in SQL preprocessing (as a short circuit) and in CAS (for consistency), also CAS can be called directly

• Close #1208 (closed)
• Cherry-pick to: none
• Docs follow-up: not necessary
• Changelog is updated