Upgrade to gds-sso to make next upgrade closer
Use the new permissions format (Array)

This upgrades gds-sso to 3.0.0, which handles both Hash and Array format
from signon. Signon currently supplies Hash, but once all apps are upgraded,
we will change it to emit an Array.
Ignore invalid user records in migration

They might be invalid for other reasons (eg they have been around for longer
than a given validation that it fails).