Description:
#17488 Added support for custom key:value pairs for user profiles, however there doesn't seem to be a way to prevent users from setting these values like with the enable_set_displayname config option
The config could either be a blanket forbid on all fields or a list of forbidden field names. I think the same behavior like with displayname and avatar_url where only admins can set the values would make sense