Allow SCIM to create an identity for an existing user

With the new SCIM identity implementation there's a gap that we need to figure out how to handle. That is, when a user already exists on the instance, but does not yet have a SCIM Identity, how do we create one?

I believe there's some level of risk if we allow creating a SCIM identity for just any user. So probably we can see if there's a SAML identity for the user for the same group, and if so, create a SCIM identity.

This should probably happen on the SCIM Create endpoint. And match based on email address?