Replace userid with UUID-backed buid across all principals

[jace]

For compliance with hasgeek/coaster#123

[jace]

Rationale for change:

1. The User model originally introduced userid as a private key to be used in API calls.
2. The Organization and Team models subsequently also received a userid column, even though "user" is a misnomer here.
3. We later standardised on the term buid for URL-safe Base64 UUIDs.
4. PostgreSQL has native support for UUID columns, with better index performance than a string value.
5. Coaster's UuidMixin now allows us to store a UUID but work with a buid interchangeably.
6. Adding a userid synonym to buid continues to propagate the "user" id misnomer, so we might as well change all references from userid to buid now. However, the legit use of the term userid in the UserExternalId model will remain.

Since public APIs can't be broken, they'll will continue to use the userid term until retirement. The GraphQL API that will replace the v1 APIs (as per hasgeek/coaster#100) will not offer a userid column.