As keycloak is the canonical source of truth and interacting with gitlab
usually requires the username as identifier. As we don't want to
accidently assign permissions to a changed username disallow changing of
usernames altogether in Gitlab.