Add docs on randomly-generated user ID

Although our sample encourage best security practices, some users may not aware that disabling/skipping some code would introduce security risks.

In our sample doc, we should specifically point out that "Direct Line enhanced authentication" is highly preferred to mitigate risks.

Some texts we could use:

• Server-side randomly-generated user ID (a.k.a. DL enhanced auth) ensure it is not trivial to have a collision on user ID
• If user ID is not specified, Web Chat currently generate user ID of r_xxxxx, where x is a combination of 36 characters (0-9, a-z), with a probability of collision of about 1 in 60M

One of the doc need to be updated: https://github.com/microsoft/BotFramework-WebChat/tree/master/samples/07.advanced-web-chat-apps/b.sso-for-enterprise#threat-model

Probably we need to update multiple of them.

Start with the threat-model section in samples/07.advanced-web-chat-apps/b.sso-for-enterprise. Review whether related sample documentation also needs the security guidance, and consider the issue's proposed wording on Direct Line enhanced authentication, server-side random user IDs, and collision risk complete when it is accurately reflected in the relevant docs.