Kafka credentials for removed users must be revoked #20
Description
Currently, when a user is removed (offboarded) from COmanage, they will become immediately unable to log in to scimma-admin, and so unable to make any changes, but existing Kafka credentials will not be revoked. This should be automated.
Implementation of this is not obvious. The main issue stems from the fact that as set up now both COmanage and scimma-admin passively wait to act on requests/queries. As soon as the user is removed, COmanage will make this information available via SAML/LDAP but will do nothing to prompt outside systems (scimma-admin, hop-creds-sync, kafka) to check that updated data and act on it. Scimma-admin will not re-examine a user's data unless they attempt to log in, which could take arbitrarily long, or may never happen. Hop-creds-sync is more proactive, running periodically, but does not interface with COmanage/LDAP, and is currently conceived to only observe the contents of scimma-admin's database, not alter them, although nothing fundamental prevents it from doing so. Neither adding a periodic, active aspect to scimma-admin, nor having hop-creds-sync take charge of user deletions seems immediately compelling as a way forward.