Fix encrypted password generator to use the LDAP username, not the Quay username.

Currently, we use the Quay username via `verify_user` when we go to create the encrypted password. This is only correct if Quay has not generated its own different username for the LDAP user, and fails if it has. We therefore add a new method `confirm_existing_user`, which looks up the federated login for the LDAP user and then runs the auth flow using that username.

data/model/legacy.py

@@ -566,6 +566,12 @@ def list_federated_logins(user):
                       FederatedLogin.user == user)
 
 
+def lookup_federated_login(user, service_name):
+  try:
+    return list_federated_logins(user).where(LoginService.name == service_name).get()
+  except FederatedLogin.DoesNotExist:
+    return None
+
 def create_confirm_email_code(user, new_email=None):
   if new_email:
     if not validate_email(new_email):