Handle first user access

When DiracX is complete, the first time a user access DiracX they need to be inserted into the CS and be assigned to zero-or-more groups. We will then need a way of monitoring if they're removed from the IdP or if they're suspended due to having not signed the AUP.

Durign the migration from DIRAC, we won't use the mechanism and will instead require two things:

* The user is already registered in the CS (e.g. from the `VOMS2CSAgent`)
* The user already has a proxy in the proxy DB