FIX: when User is rejected disassociate ReviewableUser (PR #10512)

When must approve users is set and the user is rejected, we delete User object however we keep ReviewableUser. It is good for audit purpose however we should disassociate target_id because another user may register with the same id.

In addition, I added a migration to fix data

The issue was mentioned here: https://meta.discourse.org/t/deleted-user-info-shows-up-in-new-user-approval/161720

GitHub

This seems OK to me in principle, however I feel like a lot of Discourse would break if another user can claim a previous user_id. When does this happen, imports?

@lis2 I agree with what @eviltrout is saying as well where there shouldn’t be any reuse of primary keys at all.