Describe the bug
Currently the external IDs are handled in separate external_id and net_id fields within the group member model. The net_id field is not set appropriately when first creating new member records.

Expected behavior
We should have a single external_ids map that stores the latest values of each of the external IDs in a user's token. These should be set whenever a new membership record is created, or if we notice that the external IDs in a user's token have changed.

For the moment, we should leave the external_id and net_id fields as deprecated fields for backwards compatibility, but once we have had a chance to review the impact and update the clients they can be removed completely.