Brandon/bb2 3951 saving unhashed mbi

[bwang-icf]

JIRA Ticket:
BB2-3951

What Does This PR Do?

Adds a column for the unhashed mbi in the bluebutton_crosswalk table. This will not be actively populated yet.

What Should Reviewers Watch For?

Any possible areas of our databases that have been overlooked with this

Validation

Run a local instance and connect to the local postgres db using your database manager of choice. Verify that the user_mbi column appears as expected.

What Security Implications Does This PR Have?

Please indicate if this PR does any of the following:

• Adds any new software dependencies
• Modifies any security controls
• Adds new transmission or storage of data
• Any other changes that could possibly affect security?

• Yes, one or more of the above security implications apply. This PR must not be merged without the ISSO or team
  security engineer's approval.

Any Migrations?

• Yes, there are migrations
  • The migrations should be run PRIOR to the code being deployed
  • The migrations should be run AFTER the code is deployed
  • There is a more complicated migration plan (downtime,
    etc)
• No migrations

[jimmyfagan]

The changes look good, and seem to work well, but the second AC on the ticket still needs to be addressed, which is to have the FHIR ID updated when updated from BFD during token refresh (the ticket looks like it mistakenly said to update the MBI). You can test this by doing an auth flow, then updating the FHIR ID in the crosswalk table, and then refreshing the access token. Currently, it'll continue to use the "wrong" FHIR ID, but we would want it to get updated in the crosswalk.

Also, we probably want this reviewed by the security team as well since it involved adding PII to the database and Django admin view.