Add support for email address changes with SAML when `attr_permanent_user_id` is not `email`.

Zulip’s existing authentication model is that a user’s email address is a unique ID; this simplifies the model for supporting several different authentication backends. However, where this gets messy is some SAML providers, like Shibboleth, are designed to support users changing their email address while having some other key (E.g. a unique user ID) that’s unique.

What we’d like to do is store the attr_user_permanent_id field, and then during a SAML authentication, look up users by that unique ID, and if we find one, and the email address is different, change the email address to match the SAML value.

(May need to be an optional server-letting setting, but we can worry about that once we have this prototyped)

We have existing work on the analog of this issue for LDAP here: https://github.com/zulip/zulip/pull/16208. We’ll likely want to reuse most of the logic/strategy, if we can.

See this chat.zulip.org discussion for background.

I’ve tagged this as difficult because it requires some understanding of SAML.

[seiwailai]

@ro-i Yup, I am working on this issue. Nevertheless, it is fine for me if you make a pull request to this issue

[ro-i]

In case someone wonders where the discussion about these changes is going on: https://chat.zulip.org/#narrow/stream/3-backend/topic/ext_auth_id.20create_user