Create development dataset by removal of PII from production data

[Jongmassey]

#2117 Investigated options for development datasets to reduce the need for developers to use the full prod database for local development (due to the risks of doing so).

One option is to "sanitise" or remove PII from a copy of the prod database for development (and debugging/user support) purposes.

The advantage of such an approach over generating dummy data (e.g. #2313 ) is that it is inherently a realistic representation of the prod data. This provides a greater deal of assurance that any changes made are compatible with the production data, and allows for debugging of issues with specific codelists.

#2329 is a proof of concept for doing such a thing, which has raised questions about the use of a natural (and PII-containing) key rather than surrogate for the user table.

There are also ongoing discussions about possible presence of PII in freetext fields, which should be considered.