feat: Allow password reset with non username email address

[kesara]

This change allows password reset with any email address associated with the account.
The password reset will only be sent to the active email addresses associated with the account.

Fixes #5057

[jennifer-richards]

I think will allow an inactive secondary address to be used to request the reset but will not send the link to that address. As long as we don't allow an inactive address to be associated with a different User that seems reasonable to me (thinking of the case where someone has forgotten which addresses are tied to their account).

[kesara]

I think will allow an inactive secondary address to be used to request the reset but will not send the link to that address. As long as we don't allow an inactive address to be associated with a different User that seems reasonable to me (thinking of the case where someone has forgotten which addresses are tied to their account).

Yes, that was the idea. To allow people to request for password reset with an inactive email address as well but not to send the link to inactive email addresses.

If we allow inactive email addresses to be associated with a different user, I think we will have a lot of data integrity issues.