GitLab

This prevents name clashes with old user instances. This was usually a
problem when the upstream IdP changed the subjects of our users.

The flow from here on is: When a user logs in with a changed subject
a new user is created. The old user remains (but is not accessable by the
user).