REGISTRAR: do not offer joining identities when user is known

- Backported and modified change from upstream/productionElixirFix.
  When checking for similar users, if user is known (by session or
  actor/extSource) we don't have to offer joining, since perun will
  join application on approval.

  Case when user is known by actor/extSource but not session is when
  user entry was created by previous application with auto-approval
  but session was not updated in GUI (linked app forms).

  Original version returned "no match" for any unknown user, which is not good.
  Check is not performed for non-authz users on GUI side, but this logic
  must be kept in registrar for users with federated identities which we can join
  and which might be found by name or email.