Unpublish another member's public profile

Owner or admin only. The role is read from workspace_members, not from the token. The write is rep_profile_admin_unpublish, which can change published to false and nothing else. Idempotent when already unpublished.