Support Cirrus Identity Bridge

[donsizemore]

An increasing number of institutions are using Microsoft Azure/AD for identity management, and subscribing to Cirrus Identity Bridge to integrate with the InCommon Federation.

Dataverse doesn't appear to properly parse the EPPN provided by Cirrus, and produces a useridentifier in the format user@university.edu. It would help me sleep at night if Dataverse were coded to better parse Cirrus-provided attributes, handle @ symbols in the useridentifier field, or prevent the creation of such useridentifiers in the first place.

There is also the matter of cleaning up existing accounts created under this service, and how these accounts may affect current Dataverse permissions or other operations in the mean time.

Two institutions currently using this service are Western Carolina and the University of Nevada at Las Vegas. East Carolina is preparing to subscribe to Cirrus' offerings.

Possibly related to #5579