Handle first user access

[chrisburr]

When DiracX is complete, the first time a user access DiracX they need to be inserted into the CS and be assigned to zero-or-more groups. We will then need a way of monitoring if they're removed from the IdP or if they're suspended due to having not signed the AUP.

Durign the migration from DIRAC, we won't use the mechanism and will instead require two things:

• The user is already registered in the CS (e.g. from the VOMS2CSAgent)
• The user already has a proxy in the proxy DB

[chaen]

Needs to be done here https://github.com/DIRACGrid/diracx/blob/01fb8e35fe5177273f97dab6315cb63ba6dc5e50/diracx-routers/src/diracx/routers/auth/token.py#L365 and the client should gracefully handle that