Handle duplicate email imports from otm1

This commit also contains the following improvements:
Fix how more_permissions reinstates previous roles
Drop out save with system user
Great big separate app commit
Move otm1 migrator to its own app
Replace the in-memory map of {otm1_pk: otm2_pk} with database models
Make the migrator idempotent
Uniquify duplicate usernames by adding an incremented suffix

Disable species test because species imports are currently broken.
Fix lint