Normalize config used for user-focused (grading) mode

For the purposes of this issue, note the following definitions:

* `userid` (sometimes called `accountid`): User identifier guaranteed to be unique across all Hypothesis authorities. Formatted as `acct:@`, e.g. `acct:lyzadanger@hypothes.is`
* `username`: User identifier unique _per authority only_, e.g. `lyzadanger` . There could ostensibly be a `lyzadanger` username in multiple authorities

-----

Right now, the LMS provides inconsistent user-focus configuration to the client, and the client is necessitated to support multiple variants of user-focus config. Now that we've done some refactoring on both sides in surrounding modules, I think we may be at a good point to fix this.

As I understand it—and I may be missing a piece or pieces of the puzzle here—the LMS communicates to the client that it should focus on a specific user (or not) in one of two ways:

* Canvas Speed Grader: a configuration (settings) object is provided to the embedded client "on boot" that includes the user to focus on. When switching between users, the entire iframe is replaced with new configuration (i.e. to switch between users in Canvas Speed Grader, we basically tear everything down and build it again from scratch, providing a different initial configuration to the client). The configuration object provided looks something like so:

```
"hypothesisClient":{
"focus":{
"user":{
"displayName":"Favorite Student",
"username":"f6c3ed0edd8a4013bfc8d0c22b9eca"
}
},
"services":[
// etc.
],
}
```

* Grading mode in other LMSes: No focus information is provided in the initial application configuration object. Instead, user-focus information is sent from the LMS to the client via an inter-frame RPC method. When switching users, the LMS app invokes the RPC method with a payload that looks like:

```
{
"displayName":"Favorite Student",
"username":"acct:f6c3ed0edd8a4013bfc8d0c22b9eca@lms.hypothes.is"
}
```
(Note that the value passed for `username` is actually a `userid` here).

Meanwhile, [client documentation](https://h.readthedocs.io/projects/client/en/latest/publishers/config/) claims that the `focus` configuration should look like:

```
focus: {
user: {
// required (username or userid)
username: "foobar1234",
userid: 'acct:foobar1234@domain',
// optional
displayName: "Foo Bar",
}
}
```

-----

* `username` is used by both Canvas and non-Canvas flavors of LMS grading mode, but in Canvas' case is provided as a `username` and in other cases is actually a `userid`
* AFAICT, the `userid` property is never used by LMS

Might I suggest:

* Wherever possible, use `userid` instead of `username` and pass a userid-formatting string (`acct:@`) — this should be our convention whenever possible, as its level of specificity is higher
* Wherever a userid-formatted string is sent, use the `userid` property, not `username` (i.e. don't send a userid but call it a username)