[IDP-1183, partial] Revise "external groups" API endpoints

IDP-1183 Sync prefixed-groups from Google Sheet to ID Broker's groups_external field

Add a way to run the personnel-sync locally, for dev and testing
Add an API endpoint for listing users with groups with a specific prefix
Add separate API endpoint for creating a user's prefixed external groups
- This avoids the need to include the email address in the URL path for creates, which personnel-sync does not currently support.
- This actually makes the POST behavior more typical, as you might normally POST to an endpoint for a type of resource (without a unique identifier), rather than posting to a specific resource.
Add tests for these various API endpoints

Put email and app-prefix in URL for update-external-groups API
- This would have been a breaking change, but we had not yet released that new API endpoint.
Use comma-delimited string for external groups in API endpoints
- This also would have been a breaking change, if the previous version had already been released.
- This makes it easier to sync this data with a spreadsheet (e.g. a Google Sheet), where values are just strings, not arrays.
Enable updating a user's external groups for an app to be an empty list

silinternational / idp-id-broker