allow enrolling users via sis from another root account

fixes CNVS-12963

test plan:
 * set up a trust from account A to account B
 * enable sis imports for account A and account B
 * add a user to account B with an SIS ID
 * add a course to account A with an SIS ID
 * do an sis import to account A for enrollments as user
   that is an admin in both account A and account B;
   specify the course from account A as the target,
   the user from account B, and add another column
   root_account with account B's domain
 * it should succeed, and enroll the user from account B
 * unenroll the user manually
 * do the import as a user that's an admin in account A,
   but not account B - it should fail citing permissions
 * remove the trust link from A to B
 * do the import as the user that's an admin in both;
   it should fail citing no usable login

Change-Id: Ie5b7b71bfe563da9c49d3aa2321586994634ccb5
Reviewed-on: https://gerrit.instructure.com/32133
QA-Review: August Thornton <august@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Jacob Fugal <jacob@instructure.com>
Product-Review: Cody Cutrer <cody@instructure.com>