[ENT-924] Replace sensitive SSO usernames.

*Description:* This adds a new `replace_sensitive_sso_username` flag on the `EnterpriseCustomer` model, allowing us to configure whether or not to replace sensitive SSO usernames per-customer.

*JIRA:* https://openedx.atlassian.net/browse/ENT-924

*Dependencies:* https://github.com/edx/edx-platform/pull/17910

*Merge deadline:* This sprint.

*Installation instructions:* This is only useful for https://github.com/edx/edx-platform/pull/17910, so install this branch when using that PR.

*Testing instructions:*

1. See https://github.com/edx/edx-platform/pull/17910.

*Merge checklist:*

• [ ] Check that the versions of the requirements in the `platform-master.in` file match edx-platform.

• [ ] New requirements are in the right place (`base.in` if only used in enterprise; in the correct `platform-****.in` files if they're hosted in edx-platform)

• [ ] Regenerate requirements with `make upgrade && make requirements` (and make sure to fix any errors).
  *DO NOT* just add dependencies to `requirements/*.txt` files.

• [ ] Called `make static` for webpack bundling if any static content was updated.

• [ ] All reviewers approved

• [ ] CI build is green

• [ ] Version bumped

• [ ] Changelog record added

• [ ] Documentation updated (not only docstrings)

• [ ] Commits are (reasonably) squashed

• [ ] Translations are updated

• [ ] PR author is listed in AUTHORS

*Post merge:*

• [ ] Create a tag

• [ ] Check new version is pushed to PyPi after tag-triggered build is finished.

• [ ] Delete working branch (if not needed anymore)

• [ ] edx-platform PR (be sure to include edx-platform requirements upgrades that were present in this PR)