"[E]mployers who provide incentives to employees for showing proof of vaccination by a third party, but who do not administer the vaccines themselves, may provide larger incentives because they are not receiving any disability-related information from their employees."