Extract ExternalService methods from routes

ExternalService.by_url and ExternalService#generate_login_url
Add puavo-external-service-login
Do crash on invalid users

when fetching a profile image for one
Make update-gemfile-lock to work without sudo