Restricted + Hold Account 3DPrinterOS Access

[JimSHED]

Double-whammy today; users with a hold on their account or archived (alumni) can still access 3DPrinterOS, since it is tied to passing the training.

Unsure what the solution to this could be, but we should come up with a more robust fix that also brings in #832 .

[JimSHED]

We can programmatically add and remove users from 3DPrinterOS workgroups. We use that currently for adding users when they pass a quiz. We should though;

• Only add users to 3DPrinterOS if they pass when not in a held/restricted/archived/etc. state
• Attempt to remove user from all 3DPrinterOS workgroups when archived/held/etc.
  • OK if we do this to a user not in the workgroup it just fails out, no need to do it based on what we think they are in.
• Re-add them to workgroups based on training completeness when unarchived/unheld/etc.

This is not a massive logic change, and fixes things nicely.

[ZZwatermelon]

It might be worth looking at what we do with holds & restrictions.

Intuitively it feels like there's space to implement an observer pattern to make future modification/extension easier, but I haven't thought that out fully yet.