Problem/Motivation
See #3042745: Remove group @legacy from jsonapi tests and fix deprecation messages and [#32450793], I don't fully understand yet how this all works together but I assume by overwriting the user name *field* with the label/display name can result in overwriting the actual username if that data is saved back.
I'll see if I can create a failing test to show the problem.
Proposed resolution
Not sure, but maybe the display name could be exposed as a separate thing that is explicitly read-only?
Would need to be BC somehow, of course unless we define that the current behavior is simply a bug that must be fixed.
