feat: parse scim query filters

[BruceMacD]

Summary

Parse SCIM query filters into SQL.

Branched from #3405

Checklist

• Wrote appropriate unit tests
• Considered security implications of the change
• Updated associated docs where necessary
• Updated associated configuration where necessary
• Change is backwards compatible if it needs to be (user can upgrade without manual steps?)
• Nothing sensitive logged
• Considered data migrations for smooth upgrades

Related Issues

Part of #3378

[dnephin]

Nice! This definitely looks like the most complicated part of the SCIM API so far.

I took a quick look at the scim2/filter-parser. The test coverage looks a little light, so we should make sure we have good coverage for the main cases we care about.

Do the identity providers document which filters they use, or are we kind of forced to support the entire spec?

I think the approach you've taken here to translate the expression into SQL should work well. I left some comments for making it more resilient to injection attacks (and also appease the querylinter at the same time).

[BruceMacD]

@dnephin

Do the identity providers document which filters they use, or are we kind of forced to support the entire spec?

They don't document the filters super clearly, the most common one seems to be the "email eq x" filter to see if a user exists yet. Many other inbound scim implementations dont implement all filters though, so this seems like a good base.

[dnephin]

Looks good! One suggestion for removing the pointer to interface