### Apache Airflow version

main (development)

### Operating System

From Astronomer’s QA team

### Versions of Apache Airflow Providers

_No response_

### Deployment

Astronomer

### Deployment details

_No response_

### What happened

When adding a new user, The following exception is emitted:

```
Traceback (most recent call last):
  File "/usr/local/lib/python3.9/site-packages/flask/app.py", line 2447, in wsgi_app
    response = self.full_dispatch_request()
  File "/usr/local/lib/python3.9/site-packages/flask/app.py", line 1952, in full_dispatch_request
    rv = self.handle_user_exception(e)
  File "/usr/local/lib/python3.9/site-packages/flask/app.py", line 1821, in handle_user_exception
    reraise(exc_type, exc_value, tb)
  File "/usr/local/lib/python3.9/site-packages/flask/_compat.py", line 39, in reraise
    raise value
  File "/usr/local/lib/python3.9/site-packages/flask/app.py", line 1950, in full_dispatch_request
    rv = self.dispatch_request()
  File "/usr/local/lib/python3.9/site-packages/flask/app.py", line 1936, in dispatch_request
    return self.view_functions[rule.endpoint](**req.view_args)
  File "/usr/local/lib/python3.9/site-packages/airflow/_vendor/connexion/decorators/decorator.py", line 48, in wrapper
    response = function(request)
  File "/usr/local/lib/python3.9/site-packages/airflow/_vendor/connexion/decorators/uri_parsing.py", line 144, in wrapper
    response = function(request)
  File "/usr/local/lib/python3.9/site-packages/airflow/_vendor/connexion/decorators/validation.py", line 184, in wrapper
    response = function(request)
  File "/usr/local/lib/python3.9/site-packages/airflow/_vendor/connexion/decorators/response.py", line 103, in wrapper
    response = function(request)
  File "/usr/local/lib/python3.9/site-packages/airflow/_vendor/connexion/decorators/parameter.py", line 121, in wrapper
    return function(**kwargs)
  File "/usr/local/lib/python3.9/site-packages/airflow/api_connexion/security.py", line 47, in decorated
    return func(*args, **kwargs)
  File "/usr/local/lib/python3.9/site-packages/airflow/api_connexion/endpoints/user_endpoint.py", line 105, in post_user
    user.roles.extend(roles_to_add)
AttributeError: 'bool' object has no attribute 'roles'
```

The immediate cause to this exception is F.A.B. returns `False` when it fails to add a new user. The problem, however, is _why_ excactly it failed. This is the payload used:

```json
{
    "username": "username6",
    "password": "password1",
    "email": "username5@example.com",
    "first_name": "user2",
    "last_name": "test1",
    "roles":[{"name":"Admin"},{"name":"Viewer"}]
}
```

This went through validation, therefore we know

1. The POST-ing user has permission to create a new user.
2. The format is correct (including the nested roles).
3. There is not already an existing `username6` in the database.
4. All listed roles exist.

(All these are already covered by unit tests.)

Further complicating the issue is F.A.B.’s security manager swallows an exception when this happens, and only logs the exception to the server. And we’re having trouble locating that line of log. It’s quite difficult to diagnose further, so I’m posting this hoping someone has better luck reproducing this.

I will submit a fix to correct the immediate issue, making the API emit 500 with something like “Failed to create user for unknown reason” to make the failure _slightly_ less confusing.

### What you expected to happen

_No response_

### How to reproduce

_No response_

### Anything else

_No response_

### Are you willing to submit PR?

- [X] Yes I am willing to submit a PR!

### Code of Conduct

- [X] I agree to follow this project's [Code of Conduct](https://github.com/apache/airflow/blob/main/CODE_OF_CONDUCT.md)

tests/api_connexion/endpoints/test_user_endpoint.py
response = self.client.delete(
            f"/api/v1/users/{autoclean_username}",
            environ_overrides={"REMOTE_USER": "test"},
        )
        assert response.status_code == 204, response.json  
        assert self.session.query(count(User.id)).filter(User.username == autoclean_username).scalar() == 0
    @pytest.mark.usefixtures("autoclean_admin_user")
    def test_unauthenticated(self, autoclean_username):
        response = self.client.delete(
            f"/api/v1/users/{autoclean_username}",
        )
        assert response.status_code == 401, response.json
        assert self.session.query(count(User.id)).filter(User.username == autoclean_username).scalar() == 1
    @pytest.mark.usefixtures("autoclean_admin_user")
    def test_forbidden(self, autoclean_username):
        response = self.client.delete(
            f"/api/v1/users/{autoclean_username}",
            environ_overrides={"REMOTE_USER": "test_no_permissions"},
        )
        assert response.status_code == 403, response.json
        assert self.session.query(count(User.id)).filter(User.username == autoclean_username).scalar() == 1
    def test_not_found(self, autoclean_username):
        
        response = self.client.delete(
            f"/api/v1/users/{autoclean_username}",
            environ_overrides={"REMOTE_USER": "test"},
        )
        assert response.status_code == 404, response.json