Review who has access to Ramp in one pass

**Objective:** Audit who has access to Ramp. Optionally limit to users with role `{role}` (default all roles).

**Step 1: Pull users and roles**

Call `ramp-get-user` (add `role` if one was given) and `ramp-get-role` to see what each role means. Call `ramp-get-department` for department names.

**Step 2: Look for**

* Users with an administrative base role: list every one, so the user can confirm they are expected.
* Invited users whose scheduled invitation date is long past and who never became active.
* Users with a scheduled deactivation date: confirm the date is right.
* Active users with no manager or no department.
* A manager field that points to a user who is no longer active.

**Step 3: Report**

Counts by status and role, then a findings list in the order above, each with user name, email and what to do.

**Rules & Guidelines:**

* Read only. Never call `ramp-user-add`, `ramp-user-update`, `ramp-user-deactivate` or `ramp-user-reactivate`.

**Validation:**

* If the role given matches no role in `ramp-get-role`, list the valid roles and stop.