feat: flag on cif_user table to allow or disallow session_sub update

schema/deploy/tables/cif_user_004_allow_sub_update_flag.sql

@@ -0,0 +1,20 @@
+-- Deploy cif:tables/cif_user_004_allow_sub_update_flag to pg
+-- requires: tables/cif_user_003_create_policies
+
+begin;
+
+
+alter table cif.cif_user
+  add column allow_sub_update boolean not null default false;
+
+create trigger cif_user_session_sub_immutable_with_flag
+    before update of session_sub on cif.cif_user
+    for each row
+    execute function cif_private.cif_user_session_sub_immutable_with_flag_set();
+
+-- Allowing all the existing users to update the sub once.
+update cif.cif_user set allow_sub_update = true;
+
+
+
+commit;

schema/revert/tables/cif_user_004_allow_sub_update_flag.sql

@@ -0,0 +1,7 @@
+-- Revert cif:tables/cif_user_004_allow_sub_update_flag from pg
+
+begin;
+
+alter table cif.cif_user drop column allow_sub_update;
+
+commit;

schema/verify/tables/cif_user_004_allow_sub_update_flag.sql

@@ -0,0 +1,7 @@
+-- Verify cif:tables/cif_user_004_allow_sub_update_flag on pg
+
+begin;
+
+select allow_sub_update from cif.cif_user limit 0;
+
+rollback;