UserController.switchUser accepts MANAGE_USERS

switchUser used to be permitted provided the caller has MANAGE_USERS
or CREATE_USERS. Recently it was changed to require
INTERACT_ACROSS_USERS_FULL, but that was inappropriate.

Fixes: 138952201
Test: manually verified bug is fixed
Change-Id: I49116859a9a693e657c5002235746ab4cf2cbef2