[API] Add "authorizations" table
The login process needs to unambiguously map an authentication result ("caller authenticated as firstname.lastname@example.org") to a user account ("issue a token for zzzzz-tpzed-exampleuseruuid"). In the general case this is a many-to-many relationship. Currently the "identity_url" field in the users table only permits a one-to-one mapping.A separate table should express the many-to-many relationship in order to support these situations:
- a person has multiple Google accounts, all of which should provide access to the same Arvados account
- a person can access multiple Arvados accounts without making additional Google accounts.
- method -- google, ldap, etc.
- authenticator_id -- an identifier unique to this method
- unique (user_uuid, method, authenticator_id)
Initially method will always be SSO provider (method="proxy", authenticator_id="https://sso.example.com/user/$sso_provided_uuid"?). When authentication mechanisms are implemented in Arvados proper, they will get their own methods.