Remove revoked access apps from an user's dashboard

[bobeal]

When an user is removed from the app_users of an application, the application still appears in the user's dashboard (event if he can no longer access it).

Automatically remove it from its dashboard.

[tbroyer]

This is only true if the app restricts user access to app_users / app_admins only.

This was a design decision at the time to leave it like that, such that, for example, if you remove an app_user by mistake, and immediately add them back, that would be transparent to the user (well, at least for those that are members of your organization and you don't invite as app_users by mail).
The rationale also was that the user could still remove the icon from their dashboard by themselves (well, I don't think they actually can, and that's a problem by itself IMO, but a totally different matter).

I continue to think that this is all awfully badly thought out, and that we should fix it once and for all:

• don't push icons to users' dashboards and manage a list of users who have the icon on their dashboard;
  instead use a notification to invite users to add the icon to their dashboard, with an "action" to do it with one click. If a user mistakenly removes the icon and wants it back, they can ask their admin who can send the notification again.
• because icons are all added by the users to their dashboard, don't prevent them from deleting any of them: users must be in control!

(see https://github.com/pole-numerique/oasis/issues/105)

There are other design issues related to the application model, but they can be solved separately.