feat: Implement API to GDPR delete users

[Janis4411]

This PR introduces a possible way to GDPR delete users via a API.

If we delete a user on openHPI we also have to delete the user on codeocean. Previously this was handled via a rake task that has to be triggered manually.

Part of SODEV-2997

[codecov]

Codecov Report

❌ Patch coverage is 90.90909% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 70.40%. Comparing base (7876111) to head (62fa41c).

Files with missing lines	Patch %	Lines
...rollers/api/internal/users/deletions_controller.rb	92.30%	1 Missing ⚠️
lib/tasks/gdpr_delete.rake	0.00%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #3224      +/-   ##
==========================================
+ Coverage   70.33%   70.40%   +0.07%     
==========================================
  Files         214      216       +2     
  Lines        6839     6860      +21     
==========================================
+ Hits         4810     4830      +20     
- Misses       2029     2030       +1     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[sentry]

Bug: The user deletion API endpoint always returns a success status, even if the underlying user.soft_delete! operation fails to update the database.
_{Severity: HIGH}

Suggested Fix

Check the boolean return value of user.soft_delete!. If it returns false, respond with an appropriate error status, such as head :unprocessable_entity, instead of head :ok. This ensures that failures in the soft-deletion process are correctly reported to the API client.

Prompt for AI Agent

Review the code at the location below. A potential bug has been identified by an AI
agent. Verify if this is a real issue. If it is, propose a fix; if not, explain why it's
not valid.

Location: app/controllers/api/internal/users/deletions_controller.rb#L14-L16

Potential issue: The `DeletionsController#delete` action calls `user.soft_delete!`,
which returns `false` if the database update fails. The controller does not check this
return value and unconditionally returns an `HTTP 200 OK` status. This misleads the
calling service (e.g., openHPI) into believing a GDPR-mandated user deletion was
successful when it actually failed. This behavior contradicts the established
error-handling pattern in an existing Rake task (`gdpr_delete.rake`), which explicitly
checks for failures from the same method, indicating that failures are an expected
possibility that must be handled.