Re-evaluate logic of the different provisioning bits

[xmo-odoo]

If a user loses their review rights (update_reviewers) their partner gets "emptied" and the user is moved to portal, however it's not disabled, as a result it's still returned by list_users, and thus doesn't get re-provisioned if it's enabled again.

This means e.g. if an employee leaves the company then comes back, their user needs to be updated by hand, or disabled for the provisioning to re-trigger.

This would be solved by disabling the user after portal-ing it (leaving an enabled partner record), the initial consideration was that e.g. an employee leaving to work at or as a partner's might still need to interact with the mergebot but although that is true the mergebot does not use portal, it has no portal features whatsoever. It only has portal because that's a dependency of website. Furthermore free signup is disabled, so the only way a user should be created is via provisioning (or user creation by an admin).