After account migration, MyData can still access the old inactive user account

[jameswettenhall]

See also: mytardis/mytardis#2301

MyTardis provides the ability to migrate an account (transfer ownership of data) from an old identity (with an outdated authentication mechanism) to a new identity (using OAuth2).

The MyTardis account migration renames the old account with a suffix indicating the old authentication mechanism, e.g. user1_ldap and the new OAuth account is expected to use an email address for the username, e.g. Full.Name@example.com. When MyData finds a user folder, e.g. a folder named using the email address, it tries to find the appropriate MyTardis user to grant access to, but currently the MyTardis API's /api/v1/user/ endpoint has no way to distinguish between active and inactive user accounts, so it appears possible that MyData could incorrectly grant access to the old (inactive) account instead of the new (migrated) account.