Deprecate service mapping by userID

cziegeler, kpauls, for security reasons I would like to deprecate the old service user mapping by a single userID in favor of the new format that takes one or multiple principal names.
The new format allows to keep service permissions limited to service-users as declared in the mapping and doesn't resolve declare or inherited group permissions. This gives full control over the effective permissions granted to each service and doesn't risk unrelated permission changes (e.g. to a base group like 'everyone') impacting service security.