Resolves #1314.

## Canvas Connect
### New Features
- PingPong will now save the (`iss`, `sub`) pair as an external login
based on the OIDC claim provided by the LTI platform during launch. This
change allows PingPong to match users across launches even when their
email address changes.
- The new External Login providers will not be selectable by LTI admins
when setting up new LTI connections.

## Internal
### Updates & Improvements
- `models.ExternalLogin.create_or_update` no longer enforces a check
that only one ExternalLogin for a single provider per user. This change
is required because a user might be part of more than one LTI instances
that provide OIDC claims by the same issuer.
- Removed unused `/lti/sso/providers` endpoint. The client currently
uses `/lti/public/sso/providers`.