Support Cirrus Identity Bridge

An increasing number of institutions are using Microsoft Azure/AD for identity management, and subscribing to Cirrus Identity Bridge to integrate with the InCommon Federation.

Dataverse doesn't appear to properly parse the EPPN provided by Cirrus, and produces a useridentifier in the format user@university.edu. It would help me sleep at night if Dataverse were coded to better parse Cirrus-provided attributes, handle @ symbols in the useridentifier field, or prevent the creation of such useridentifiers in the first place.

There is also the matter of cleaning up existing accounts created under this service, and how these accounts may affect current Dataverse permissions or other operations in the mean time.

Two institutions currently using this service are Western Carolina and the University of Nevada at Las Vegas. East Carolina is preparing to subscribe to Cirrus' offerings.

Possibly related to #5579

Start by tracing Dataverse's handling of Cirrus-provided EPPN values and the resulting useridentifier field, then review related issue #5579. Define the desired behavior for @ symbols, new account creation, and existing accounts' permissions before identifying implementation and test entry points.