Lock externalId while creating to avoid creating duplicate user accounts

There is UI work to avoid this from happening:

https://github.com/oaeproject/3akai-ux/issues/3185

But there should be back-end work to handle the data-integrity of this case.

1. Lock the externalId for the tenant using the locking api (with a reasonably low timeout of maybe 15 seconds)
  * If you don't get the lock, return an error saying the account already exists
2. Create the account
3. Unlock the externalId (in successful scenarios as well as error scenarios)

Further requests to create an account with a duplicate external id will error that the account already exists by virtue of it existing in cassandra.

This way the UI work is protecting against a bizarre "Account already exists" error, rather than a data-integrity issue.