Support any user identifying attribute in APIs

[Macroz]

Since userid should be an opaque internal id, we should support specifying any of the external user identifying attributes from :oidc-userid-attributes in the APIs where a :userid is currently expected.

• change APIs to search for the user from one of :userid or :oidc-userid-attributes. First one will be used.

See https://github.com/CSCfi/rems/blob/master/docs/architecture/014-userids.md and particularly https://github.com/CSCfi/rems/blob/master/docs/architecture/014-userids.md#login

[Macroz]

There were three cases:

1. x-rems-user-id which is handled in the middleware
2. application commands, which have a Schema, and the command is patched in handle-command
3. blacklist API, which can receive a userid as query parameter