Prevent superadmin un-confirmation if UI bypassed

`spec/controllers/super_admin/users_controller_spec.rb`:
- Added test to prevent un-confirming of any super admin email within app
`app/controllers/super_admin/users_controller.rb`:
- Added !@user.can_super_admin? check to enable the aforementioned test to pass
- Also, updated a `patch` statement to `put`

Author: aaronskiba

app/controllers/super_admin/users_controller.rb

@@ -143,8 +143,8 @@ def handle_confirmed_at_param(attrs)
       # if an unconfirmed email is now being confirmed
       if !@user.confirmed? && attrs[:confirmed_at] == '1'
         attrs[:confirmed_at] = Time.current
-      # elsif a confirmed email is now being unconfirmed
-      elsif @user.confirmed? && attrs[:confirmed_at] == '0'
+      # elsif a confirmed email is now being unconfirmed and the user is not a super admin
+      elsif @user.confirmed? && attrs[:confirmed_at] == '0' && !@user.can_super_admin?
         attrs[:confirmed_at] = nil
       else
         # else delete the param

spec/controllers/super_admin/users_controller_spec.rb

@@ -36,10 +36,18 @@
         # (usec: 0) removes mircoseconds to better enable comparison
         user.update(confirmed_at: Time.current.change(usec: 0))
         original_confirmed_at = user.confirmed_at
-        patch :update, params: { id: user.id, user: { firstname: 'NewName', confirmed_at: '1' } }
+        put :update, params: { id: user.id, user: { firstname: 'NewName', confirmed_at: '1' } }
         user.reload
         expect(user.confirmed_at).to eq(original_confirmed_at)
       end
     end
+
+    context 'when attempting to set a super_admin to unconfirmed' do
+      it 'does not update confirmed_at value to nil' do
+        put :update, params: { id: super_admin.id, user: { confirmed_at: '0' } }
+        super_admin.reload
+        expect(super_admin.confirmed_at).not_to be_nil
+      end
+    end
   end
 end