Broken Trino impersonation #371

In #330 I set input: false on user.additionalFields.username to stop users from changing it through /api/auth/update-user.
But better-auth also applies input: false to the OAuth provider profile: parseAdditionalUserInputFromProviderProfile skips such fields, so the username returned by mapProfileToUser is dropped when the user is created.

Without a username, the Trino API routes fall back to locals.user?.username ?? 'anonymous', which hides the error and breaks impersonation.

• Fix and restore old behavior
• While also ensuring that the Issue in fix(auth): prevent users from gaining additional permissions #330 can not be exploited
• Add regression tests