Core API Read endpoint returning unlinked OrgIdentity

The Core API Read endpoint will return an unlinked OrgIdentity that was at one point linked to the CO Person record but is no longer linked.

To reproduce, create an "invitation" enrollment flow and run it so that it the first OrgIdentity used for the invitation is created. Configure the enrollment flow with an EnvSource OIS in Authenticate or Identity mode so that when the enrollee accepts the invitation a second OrgIdentity (usually with Identifiers from EnvSource) is created.

Now as an administrator manually unlink the first OrgIdentity from the CO Person record.

Then use the Core API Read endpoint to pull the CO Person record. It will contain both OrgIdentities even though the first one was unlinked.