users: don't allow gifting upgrades to demote privileged users.

Don't allow gifting Gold or Platinum upgrades to users above Platinum
level. Fixes an exploit where you could demote Builders and above by
gifting them an upgrade.

test/functional/user_upgrades_controller_test.rb

@@ -77,6 +77,16 @@ class UserUpgradesControllerTest < ActionDispatch::IntegrationTest
         end
       end
 
+      context "an upgrade for a user above Platinum level" do
+        should "not demote the user" do
+          @builder = create(:builder_user)
+          post_auth user_upgrade_path, @user, params: { stripeToken: @token, desc: "Upgrade to Gold", user_id: @builder.id }
+
+          assert_response 403
+          assert_equal(true, @builder.reload.is_builder?)
+        end
+      end
+
       context "an upgrade with a missing Stripe token" do
         should "not upgrade the user" do
           post_auth user_upgrade_path, @user, params: { desc: "Upgrade to Gold" }