Use Auth0's `sub` identifier instead of email to identify a todo owner

[andrewhlu]

Not really a bug, but this is something we should do to prevent issues in the future.

In PR #44, with the introduction of authControllerAdvice, we are now populating the id field of a new todo with the user's email instead of the unique identifier provided by Auth0 (see TodoController.java:42). This would potentially create the following issues if any of the following things occur:

• Auth0 is expanded to allow multiple 3P identity providers, and two accounts on separate 3P identity providers use the same email address. This would make the todos visible on both accounts, which could be a security concern.
• A user changes their email address with the 3P identity provider. This would lead to the user losing all their previous todos.

Instead of using the user's email to identify todo owners, we should instead look into using the sub identifier provided by Auth0, since this is unique for every account (even if two accounts share the same email address) and immutable (even if an account's email address is changed).

Acceptance Criteria

• When a todo is created, the userId is populated with the sub identifier instead of an email address
• Todos should be retrieved using the sub identifier instead of an email address

[scottpchow23]

I actually think we should just use a created user's id from our new AppUser object. Thoughts @andrewhlu?

[andrewhlu]

That also works as a way to map a todo to an AppUser.
But we now have to update the AppUser to be uniquely identified by the sub identifier, instead of email address, since the issue is also present there. See AuthControllerAdvice.java:53.