Redesign user identification & mail delivery for Shibboleth users

Use EPPN for user identification, mail is an optional parameter not used yet, i.e. it's not atm. guaranteed that mail delivery will work if user login with Shibboleth [1].

Then again, nothing guarantees that the mail attribute has a valid value even if it exists.

Also these attributes should be parametrised as different deployments might use different Shibboleth attribute schemas.

1: https://confluence.csc.fi/display/HAKA/Usein+kysytyt+kysymykset#Useinkysytytkysymykset-Sähköpostiosoitekäyttäjänyksilöimisessä

Start by tracing the Shibboleth login and user-attribute handling in the Python application. Determine how EPPN and the optional mail attribute are currently used, then clarify the deployment-specific attribute configuration and the expected behavior when mail is absent or invalid.

Written by the indexing model from the issue text.