SSP-1526 Enforce PERSON_LEGACY_REMARK_READ

Includes normalizing API changes for the Notes tool. What was
previously:

  /ssp/api/1/person/{schoolId}/note/student

Is now:

  /ssp/api/1/person/{uuid}/note

This is more consistent with the rest of our /person-scoped
APIs, but does mean the API is now limited to finding notes
for users who have a record in the person table. This
fits our current UI use case, though. If we eventually
need a notes lookup for anyone in external_person, we'll
need a different API signature. When we've had to do
something like this in the past it's turned into something
like this:

For lookup by internal ID:

  /ssp/api/1/person/{uuid}

For lookup by school ID:

  /ssp/api/1/person/bySchoolId/{schoolId}

FWIW, that design isn't particularly RESTful b/c "bySchoolId"
is not a property of the entities returned by /person. More
correct would probably be to factor it as a query param whenever
searching by a non-canonical ID:

  /ssp/api/1/person?schoolId={schoolId}