detect personal information for anonymous contacts

Users tend to provide their personal details (email address, NI number) even if we explicitly ask
them not to. In order to avoid storing an ever-increasing amount of personal information within the contacts
database, this change introduces a rudimentary mechanism for flagging personal data.

If a new record is deemed to contain an email address or NI number, the `personal_information_status`
field will be set to `suspected`. Once there is an API and frontend for the contacts DB:

- "suspected" entries won't be shown to users who query the contacts DB
- there will be tooling to approve or anonymise suspected entries

/cc @bradleywright could you have a look please?