API: Allow filtering users on last_login/date_joined

[valentijnscholten]

Allow filtering on last_login and date_joined to help users manage user via the API. Inspired by #12611

[dryrunsecurity]

This pull request contains a potential security concern in the ApiUserFilter where sensitive user metadata could be exposed, though the current implementation has some access controls in place through the UsersViewSet permissions.

Sensitive User Information Exposure in dojo/filters.py

Vulnerability	Sensitive User Information Exposure
Description	The ApiUserFilter exposes multiple sensitive user fields like is_active, is_superuser, last_login, and date_joined. While the UsersViewSet is restricted to superusers via permission_classes, the filter itself allows detailed querying of user attributes. This could potentially leak sensitive user metadata if access controls are not strictly maintained.

django-DefectDojo/dojo/filters.py

Lines 85 to 91 in 458332f

	Test_Import_Finding_Action,
	Test_Type,
	TextQuestion,
	User,
	Vulnerability_Id,
	)
	from dojo.product.queries import get_authorized_products

---

All finding details can be found in the DryRun Security Dashboard.

[mtesauro]

Approved