Combine email and username in MapIdentityApi

[halter73]

This makes MapIdentityApi more like Identity UI. The main difference is we're now forcing the user's email to match their username internally therefore we expose just the Email in MapIdentityApi requests and responses. There are no longer any Username parameters. This makes MapIdentityApi more compatible with Identity UI and simplifies threat modeling them both.

The main differences from before are:

• Email is now the username
• Email always goes through basic validation by EmailAddressAttribute even if RequireUniqueEmail = false.
• The GET /2fa endpoint is now removed. You must at least send an empty JSON object ({}) in a POST body to see 2fa details like the shared key.
• Split the /forgotPassword and /resetPassword endpoints like Identity UI.
• The BearerTokenHandler no longer supports reconfiguring ExpiresUtc like other non-cookie auth handlers. It never supported adjusting the refresh token expiration per-signin either. And it never supported IssuedUtc or any other AuthenticationProperties.

Contributes to #48433

[BrennanConroy]

Idk much about the design, just reviewing the code changes 😃

[BrennanConroy]

Should this text be configurable eventually?

I'm reminded of the "We will never ask you for this code" story we heard recently 😄

[halter73]

Probably. It's not configurable with Identity UI, but you can more easily override razor pages than these endpoints. And you can scaffold them out. You could parse out the code in your IEmailSender and do whatever, but that'd obviously be very fragile.

I think in the future we might have a higher-level abstraction with methods like SendEmailConfirmationAsync and SendPasswordResetAsync and a TUser parameter. The default implementation could then just resolve the IEmailSender and use the existing strings. That's not something we need to do immediately though.

[augustevn]

This feels like been developed on a friday evening ...
the confirmation tag was close enough, too bad for the bug with the absolute url.
But this? Couldn't you at least follow a similar approach as with the confirmation htmlMessage.

A configurable link would've been nice so we can make it either go to our backend or frontend to get the code from the query param. Expecting an app user to copy it correctly into a form field, is completely ridiculous. Most can't even paste an image URL, they copy their website address and hope for a wonder.