When generating Visas (permissions API), Allow operators to configured what attribute is the user identifier

**Is your feature request related to a problem? Please describe.**

We have integrated GDI User Portal with REMS. To reduce the scope of the access token, we have a Keycloak managing user identity between User Portal and REMS, with LS-AAI as an Identity Provider.

The user does login, creates, drafts and submits the application via User Portal. Under the hood, the User Portal creates the user in REMS, sending user id generated by Keycloak, email, name and surname.

The Application handler receives the application, reviews and decides on it via REMS. If positive, the application is approved.

Any service provider (ie beacon network) that wants to validate credentials must call LS-AAI to get the GA4GH passport, then LS-AAI calls the REMS to generate GA4GH visas. At that moment, we have an issue because the user id is the keycloak id, not LS-AAI id.

**Describe the solution you'd like**
Given we have this situation where we can have different Identity Brokers, we need to ensure the mapping between user ids are correctly managed.

My suggestion is that REMS should clearly specify what is the attribute used as network/federation user identifier in the context of GA4GH visas, which must be different to the contextual user identifier (localised, within the system).

**Describe alternatives you've considered**

There three different options, in my view:
- Via API and schema. This is more on the functional level, whenever creating a user (via login, or via API, or via CLI), REMS could clearly separed the two subjects, VISA USER ID and USER ID.
- Via environment variable. The default value would be `userId`, but then we could assign `ls_aai_id` to that environment variable, and then collect it in the create user step:
- via login, collected from the access_token,
- via API as part of extra fields collection or something similar
- via CLI also via extra fields collection.
- Via integration with LS-AAI. REMS exchanges access_token from Keycloak to LS-AAI access_token, and from it collect the identifier, and assign visas.

**Additional context**
Add any other context or screenshots about the feature request here.