fix: prevent impersonating superadmin users

src/Security/Voter/ImpersonationVoter.php

@@ -39,6 +39,11 @@ class ImpersonationVoter extends Voter
             return false;
         }
 
+        // if the target user is superadmin, do not grant access
+        if (true === $targetUser->isSuperAdmin()) {
+            return false;
+        }
+
         // Admin is the only role allowed to impersonate
         if (false === $this->security->isGranted('ROLE_ADMIN')) {
             return false;