Ability to merge a local account into a remote (federated) account
We have the ability in the API server and workbench to migrate users, this means means reassigning ownership of objects from one user to another, and redirecting one local user login to another.
For federation, we will want to extend this feature to be able to migrate a local user account to a federated identity (a "remote" user). This means:
- Everything owned by the "local" user is reassigned to the remote user
- One of:
- logging in as the local user actually logs in (for that cluster only) as the remote user.
- OR logging in with the local account is deactivated and only federated login is possible
- API server "user merge" feature needs to work when one of the users are a remote user
- May depend on additional login flow for federated logins (#12958)