feat: redact email PII in UnregisteredLearnerCohortAssignments before deletion

[ttak-apphelix]

Description

During user retirement, UnregisteredLearnerCohortAssignments records were being deleted without first redacting the email field. This meant downstream systems (e.g. Snowflake) could see the raw email address in CDC/replication logs at the moment of deletion.

This change redacts the email to its retired (hashed) value before deleting the record, consistent with how PII is handled for other tables during the retirement pipeline.

Private JIRA ticket

https://2u-internal.atlassian.net/browse/BOMS-565

Changes

openedx/core/djangoapps/user_api/accounts/views.py

• Replaced UnregisteredLearnerCohortAssignments.delete_by_user_value() with an explicit ID-based redact-then-delete:
  1. Collect matching record IDs by original_email
  2. Bulk UPDATE email to retired_email using id__in
  3. Bulk DELETE those same IDs

openedx/core/djangoapps/user_api/accounts/tests/test_retirement_views.py

• Added test_cohort_assignment_email_redacted_before_delete to verify at the SQL level (via CaptureQueriesContext) that:
  • UPDATE precedes DELETE in the query stream
  • Both operations use id IN (...) filtering
  • The UPDATE sets email to the retired (hashed) value
  • An unrelated record with the same email is not affected

Testing

• New test test_cohort_assignment_email_redacted_before_delete in TestAccountRetirementPost covers the fix end-to-end including the SQL query order and ID-based filtering assertions.
• Existing test_retire_user continues to assert the record is deleted.

[ktyagiapphelix2u]

Look good to me