Security: Validate email when saving

Problem/Motivation

Claude Opus 4.8 analysis:

  ChangeEmailNoPassword.php:106-107
  $account->setEmail($email_address);
  if (boolval($account->save())) {
  save() does not run entity constraint validation. In Drupal, both email format (Email constraint) and email uniqueness
  (UserMailUnique) are enforced only when $account->validate() is explicitly called (as forms and JSON:API do). Saving
  directly skips both.

  Consequences:
  - Duplicate email / impersonation vector: a user can set their email to an address already used by another account
  (including an admin's). Drupal has no DB-level unique constraint on mail, so the collision persists silently. This
  corrupts the assumption that email→account is unique and can interfere with the victim's password-reset flow
  (user_load_by_mail / reset keyed on email becomes ambiguous).
  - Malformed data: any string passes — "not-an-email", an empty string, strings with whitespace/newlines. An empty email
  can break the account's own password-recovery path.