Clear conflicting external_id when enrolling manual profile into SCIM

When a SCIM provider sends CreateUser for a user whose email matches an
existing manual profile, but another profile already holds that
external_id (e.g. created by a prior CreateUser with a different email),
clear the conflicting external_id before enrolling the manual profile.

Signed-off-by: Bryan Frimin <bryan@getprobo.com>

pkg/iam/scim/service.go

@@ -244,6 +244,18 @@ func (s *Service) CreateUser(
 				return scimerrors.ScimErrorUniqueness
 			}
 
+			if externalIdPtr != nil {
+				if err := profile.ClearExternalID(
+					ctx,
+					tx,
+					scope,
+					*externalIdPtr,
+					config.OrganizationID,
+				); err != nil {
+					return fmt.Errorf("cannot clear conflicting external id: %w", err)
+				}
+			}
+
 			profile.Source = coredata.ProfileSourceSCIM
 			profile.State = profileState
 			profile.FullName = attrs.FullName