These models should be one-to-one. Various bugs in the past have
leaked violations in both directions; we clean them up such that every
PreregistrationUser which is not a multi-use invite has exactly one
Confirmation object associated with it.
Fixes: #22025