enrollments API requires pseudonym on course's root account

in order to enroll a user in a course via the API, the user
being enrolled must have an active pseudonym that works
with the course's root account.

test plan:
 - an account administrator or site administrator should
   receive a user-not-found (status 404) error when trying
   to use the API to enroll a user in a course where the user
   does not have a login in the course's root account (i.e.,
   the user "belongs to a different institution"),
   AND the course's root account is _not_ the default account
   (since the default account trusts everybody; this allows
   anyone to enroll in FFT courses)
 - you should be able to create an Observer via the course's
   people page and link that observer to students in the course
   before creating a login for the observer.

fixes CNVS-12020

Change-Id: Ib058d9b78830347e6fadfdc86bf4325aa557c325
Reviewed-on: https://gerrit.instructure.com/32374
Reviewed-by: Brian Palmer <brianp@instructure.com>
Reviewed-by: Rob Orton <rob@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
QA-Review: Matt Fairbourn <mfairbourn@instructure.com>
Product-Review: Jeremy Stanley <jeremy@instructure.com>