ORCID iDs should not be inputted manually

Is your feature request related to a problem? Please describe.

Currently it is possible for unverified ORCID iDs to enter author metadata/account data through manual entry. This results in various user errors -- forgetting characters, inputting in incorrect format, inputting someone else's ORCID iD, etc. The only way that one can confirm that an individual holds an ORCID iD is by asking them to authenticate their iD by signing into ORCID and granting Janeway permission to obtain their ORCID iD and perhaps other data on their ORCID record.

Describe the solution you'd like

Authentication status should be determined by a valid access token.

1. Add to user account table a new column "orcid token"
   a. Add to the ORCID workflow: After exchanging the auth code for an ORCID iD and access token, store both the ORCID iD and access token
   b. Admin can remove ORCID iD or reset access token to force re-authentication (for whatever reason, eg switching from Public API -> Member API, switching from Janeway host A to Janeway host B)

2. User profile authentication: Account holders should be prompted to authenticated their ORCID iD and should not be able to input manually:
   

   When a user logs in, and there is no ORCID access token on their account, display a message to the user prompting them to re-connect their ORCID iD for validation.

   When loading a user’s personal account profile, the system should use the stored access token to check whether the token is valid (eg GET the user’s ORCID iD). If the token is not valid, or if there is no token, display a grey or red X version of the ORCID iD icon and ask the user to reconnect their ORCID iD (or something similar). Any DOI metadata with this user's ORCID iD
   

   When a user clicks “Remove”, revoke the access token so the user will no longer see e.g. “Janeway” listed in their ORCID account settings. This can prevent an incorrect ORCID iD from being accidentally connected to the wrong account due to existing permissions. ref: https://members.orcid.org/api/oauth/revoke-tokens

3. Visual indication of authentication: If the user is an author of a paper in Janeway, and there is no ORCID access token associated with their account, then a grey version of the ORCID iD icon should be displayed with alt or hover text that it has not been validated.

[edit] Removed co-author iD request -- moving to another FR