fix: Always save generated anonymous user ID in DB; ignore save=False (#26399)

This deprecates `save=False` for several functions and removes all known
usages of the parameter but does not actually remove the parameter.
Instead, it will emit a deprecation warning if the parameter is used.
We can remove the parameter as soon as we feel sure nothing is using it.

Now that we have refactored `anonymous_id_for_user` to always prefer
retrieving an existing ID from the database -- and observed that only a
small fraction of calls pass save=False -- we can stop respecting
save=False. This opens the door for future improvements, such as generating
random IDs or switching to the external user ID system.

Metrics: I observe that 1 in 16 requests for new, non-request-cached
anon user IDs are made with save=False. But 71% of all calls are served
from the request cache, and 99.7% of the misses are served from the DB.
save=False only appear to come from intermittent spikes as reports are
generated and are low in absolute number.

Also document usage/risk/rotation of secret in anonymous user ID
generation as indicated by `docs/decisions/0008-secret-key-usage.rst`
ADR on `SECRET_KEY` usage.

ref: ARCHBOM-1683

lms/djangoapps/instructor/views/api.py

@@ -1413,7 +1413,7 @@ def get_anon_ids(request, course_id):
         courseenrollment__course_id=course_id,
     ).order_by('id')
     header = ['User ID', 'Anonymized User ID', 'Course Specific Anonymized User ID']
-    rows = [[s.id, unique_id_for_user(s, save=False), anonymous_id_for_user(s, course_id, save=False)]
+    rows = [[s.id, unique_id_for_user(s), anonymous_id_for_user(s, course_id)]
             for s in students]
     return csv_response(text_type(course_id).replace('/', '-') + '-anon-ids.csv', header, rows)
 

lms/djangoapps/teams/api.py

@@ -392,7 +392,7 @@ def anonymous_user_ids_for_team(user, team):
         ))
 
     return sorted([
-        anonymous_id_for_user(user=team_member, course_id=team.course_id, save=True)
+        anonymous_id_for_user(user=team_member, course_id=team.course_id)
         for team_member in team.users.all()
     ])