Pull Request for Issue # .

Summary of Changes

Our Form API has unset filter which is used to disallow changing certain data if the current user does not have permission to change. We use it to handle other fields such as ordering, published.... https://github.com/joomla/joomla-cms/blob/4.0-dev/administrator/components/com_contact/src/Model/ContactModel.php#L194-L196 , so created_by should not be treated in different way.

Testing Instructions

1. Modify this line of code https://github.com/joomla/joomla-cms/blob/4.0-dev/layouts/joomla/form/field/user.php#L138 to:

<?php if (true) : ?>

2. Apply this PR to your Joomla 4 installation.

The purpose is to have the the hidden field always rendered so that you can use browser inspect element tool to change hidden input variable to change created by data of a record.

3. Login to administrator area of your site using a Manager account (by default, Manager account does not have permission to manage users, so he won't be allowed to change Created By data of article)

4. Access to Content -> Articles, click on an article to edit. Navigate to Publishing tab, look at Created By field, you will see that it is readonly, mean you are not allowed to change Created By of the article
   

5. Inspect that Created By element, try to change the value of the hidden input (which stores ID of the user who created that article) to a different value
   

6. Save article. Then edit it again, check and make sure Created By is not changed (it still keeps the original user, not change to the new user which you changed)

Actual result BEFORE applying this Pull Request

Works, but has to override method validate in some model classes. Code is in-consistent with the way we handle other fields.

Expected result AFTER applying this Pull Request

Works, do not need to override validate method in model classes to just unset the field. Code is consistent with how we handle other fields data.