Admin user controller doesn't respect some abilities

[halilim]

1. #collection does not check the current admin's abilities and returns all users. It can probably be fixed by using super.ransack... which makes use of #accessible_by.
   

   solidus/backend/app/controllers/spree/admin/users_controller.rb

   Line 127 in 4079b58

   @search = Spree.user_class.ransack(params[:q])

2. Similar issue for #load_roles, #load_stock_locations & #set_stock_locations, though super wouldn't cut it in these cases.
   

   solidus/backend/app/controllers/spree/admin/users_controller.rb

   Lines 163 to 164 in 4079b58

   	def load_roles
   	@roles = Spree::Role.all

   
   

   solidus/backend/app/controllers/spree/admin/users_controller.rb

   Lines 170 to 171 in 4079b58

   	def load_stock_locations
   	@stock_locations = Spree::StockLocation.all

   
   #load_stock_locations also doesn't respect user_params and uses params directly instead.
   

   solidus/backend/app/controllers/spree/admin/users_controller.rb

   Lines 180 to 181 in 4079b58

   	def set_stock_locations
   	@user.stock_locations = Spree::StockLocation.where(id: (params[:user][:stock_location_ids] || []))

3. #set_roles checks the general ability but not the roles given in params. I.e. a role that can't be managed could be given to a user by manually passing its id in params.
   

   solidus/backend/app/controllers/spree/admin/users_controller.rb

   Lines 175 to 176 in 4079b58

   	if user_params[:spree_role_ids] && can?(:manage, Spree::Role)
   	@user.spree_roles = Spree::Role.where(id: user_params[:spree_role_ids])

Solidus Version:
2.10.1

To Reproduce
In Admin > Users, with an admin whose permissions defined as:

cannot :manage, ::Spree::User, ['some SQL'], &:foo?
cannot :manage, ::Spree::Role, ['some SQL'], &:bar?

Current behavior

1. Users with foo? => true are listed
2. Roles with bar? => true are included in Search > Roles, New User > Roles etc.
3. Roles with bar? => true can be assigned to a user

Expected behavior

1. Users with foo? => true are not listed
2. Roles with bar? => true are excluded from Search > Roles, New User > Roles etc.
3. Roles with bar? => true cannot be assigned to a user

[kennyadsl]

We can close this one. Thanks @igorbp and @halilim for reporting!