Enable server-side support for multiple IdPs in the CANFAR Science Platform

Science Platform adaptations required for multiple IdP support:

1. modify cadc-util library to define a suitable immutable principal (issuer+subject) type; deprecate NumericPrincipal 
2. Use immutable principal in scenarios where caller identity is stored (uws)
3. For token validation, have the Standard Identity Manager supports multiple issuers.  (or, alternatively, configure a cooperating set of IdP proxies that work together to validate tokens.)
4. modify posix-mapper service need to handle multiple IdPs and multiple GMS services: use immutable principal instead of HttpPrincipal(username), handle group URI collisions (same name, different authority) in a sane way... but the result is constrained by posix and visible to users in the platform.
5. Token exchange for GMS calls:  IAM to return or provide a scoped token for making the auth calls to GMS.
6. cavern integration - cavern relies on the posix-mapper API to map subject<->uid/gid pair and uses PosixPrincipal to persist identity in the filesystem (so not effected directly, just reconfig and rebuild); will include uws updated identity handling
7. skaha integration - skaha relies on the posix-mapper API to generate uidmap and gidmap for science containers (so not effected directly, just reconfig and rebuild)
8. Create OIDC IdP selector on portal login.

possible additional work – maybe separate features:

1. consider logging immutable identity? and/or consider GDPR -compliant logging?