Adjust behavior users that mis-matched ExternalId

[ChrisPates]

If an ExternalId mismatches, check for an email address match, if a match is found and the ExternalId is not set/set to nul, then update with the relevant ExternalId. This allows for matching existing locally created users, on first sync via ssosync. This is an important adoption route.

Issue #, if available:
#358

Description of changes:
Where a user in Google Workspace Directory (gUser) fails to match with a user in IAM Identity Store (awsUser) based on gUser.Id = awsUser.ExternalId, but matches on gUser.PrimaryEmail. Then the following logic is applied.

• If the awsUser.ExternalId is null or unset, then the user is updated with gUser.Id as its ExternalId and any other fields are synchronized.
• If the awsUser.ExternalId is set up doesn't match, then the existing awsUser is deleted (breaking anyt permission assignments), and a new awsUser is created.

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.