Anonymizes an applicant's personal data per GDPR right-to-erasure, except for the data/structured_data/secure_data keys listed in data_whitelist, which are preserved as-is. Idempotent — a no-op if the applicant has already been anonymized.