When the `:scim_identities` feature is enabled, allow SCIM to
associate with an existing user - create the SCIM identity, and
add the user as a member of the group.

This closes a gap compared to the prior implementation where an existing
SAML identity would be used to associate SCIM (since SAML + SCIM
identities were the same).

We also have more latitude to associate a dedicated SCIM identity
with an existing user because there's no security risk of account
takeover as with SAML identities.