Don't allow org identity to have multiple co people in same CO

Via either database constraints or controller checks, don't allow the same org identity to be added to the same CO as a second CO Person. (Additional person roles should be added instead.)