cache avatar url in attendee

[Jumpy-Squirrel]

every time an attendee is seen, we should cache the avatar url from their JWT.

This information should be made available in the various attendee related endpoints, but read-only.

Right now, updates would only occur if the user visits the registration system. Maybe at some point the identity provider will provide profile lookups or webhooks.

This is also needed by the room-service.