Added a `ShibbolethMetadata` CF

The Shibboleth authentication strategy will now persist:
 - the Shibboleth persistent id
 - the IdP
 - the user's affiliation
to the `ShibbolethMetadata` CF. The information is keyed by the loginId.

The persistent ID allows us to retrieve extra attributes later on.

`AuthenticationAPI.getOrCreateUser` now also exposes the loginId that is
associated to a user object.