Account self-deletion

[jsharkey13]

This PR adds two new endpoints:

• an endpoint to allow a logged in student with an account email address that is not DELIVERY_FAILED to request an account deletion link be sent to their email address;
• a second endpoint to take the random token sent to the account email address and delete the user's account.

I have several questions about this implementation:

• Tokens are valid for 7 days; I didn't want open-ended validity, but 24 hours like password resets seemed unnecessarily short. Is this okay?
• You have to be logged in to use the deletion token; rather than include the user ID in the URL, just force the user to be logged in. If the email is sent right away, this is likely not an issue?
• Is the email facade the right place for these endpoints to live? Could the manager level code be better located?

[codecov]

Codecov Report

Attention: Patch coverage is 35.59322% with 76 lines in your changes missing coverage. Please review.

Project coverage is 34.39%. Comparing base (586d96e) to head (e94e293).
Report is 12 commits behind head on master.

Files with missing lines	Patch %	Lines
...e/dao/users/PgDeletionTokenPersistenceManager.java	37.83%	21 Missing and 2 partials ⚠️
...n/java/uk/ac/cam/cl/dtg/segue/api/EmailFacade.java	29.16%	17 Missing ⚠️
.../segue/api/managers/UserAuthenticationManager.java	31.57%	12 Missing and 1 partial ⚠️
.../cl/dtg/segue/api/managers/UserAccountManager.java	26.66%	11 Missing ⚠️
...m/cl/dtg/isaac/dos/users/AccountDeletionToken.java	52.94%	8 Missing ⚠️
...cam/cl/dtg/segue/auth/SegueLocalAuthenticator.java	0.00%	2 Missing ⚠️
...e/configuration/SegueGuiceConfigurationModule.java	0.00%	2 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##           master     #652      +/-   ##
==========================================
+ Coverage   34.16%   34.39%   +0.23%     
==========================================
  Files         519      521       +2     
  Lines       23264    23378     +114     
  Branches     2854     2863       +9     
==========================================
+ Hits         7947     8042      +95     
- Misses      14515    14528      +13     
- Partials      802      808       +6     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[mwtrew]

Pair-reviewed with @axlewin.

The general approach looks good. I think I would lean towards a shorter expiry time, especially since we're requiring login on the basis that the user will probably act on it quickly.

I don't have a strong opinion about where the code lives, I would perhaps lean towards the user facade/manager so it's in the same place as the account creation logic but this is also fine.

Some integration tests for various scenarios (happy path, using another user's token, expired token) would be nice.

[jsharkey13]

Let's bring the time down to 1 day, as for password resets. Then I will have a go at adding some integration tests.