CLC-2252 Support reformatting of Canvas SIS user IDs

https://jira.media.berkeley.edu/jira/browse/CLC-2252

Although the priority is considered high, it's also risky, since this is an untested change to our Canvas UX and to our integration scripts. By default, the new variable SIS user ID scheme is disabled, and the existing LDAP-only scheme remains in place. The IDs can be flipped back and forth via the server config, but we need to make sure that ensuing Canvas-refresh runs use the same setting as the SIS user ID conversion did.

A few related changes:
- New proxies are needed.
- The Canvas refresh script now uses the enrollment/instructor SQL queries to build the users import file rather than doing extra DB queries.