Fixes T5506. Depends on D10133. When users remove an email address or change their primary email address, invalidate any outstanding password reset links.

This is a very small security risk, but the current behavior is somewhat surprising, and an attacker could sit on a reset link for up to 24 hours and then use it to re-compromise an account.

• Changed primary address and removed addreses.
• Verified these actions invalidated outstanding one-time login temporary tokens.
• Tried to use revoked reset links.
• Revoked normally from new UI panel.