add a way for admins to set username when profiles are locked

src/users.js

@@ -546,6 +546,7 @@ async function update(user, data, auditSource) {
     if (_.isEmpty(data)) return;
 
     if (data.username) {
+        if (user.username) throw new BoxError(BoxError.BAD_FIELD, 'Username cannot be changed');
         data.username = data.username.toLowerCase();
         error = validateUsername(data.username);
         if (error) throw error;