Store more detail in EmailTracker

To give us more information when debugging reported email issues, we should store more information when we send an email:

- `recipientEmails` - In addition to the existing `recipient`, we should record the list of actual email addresses the email was sent to. This should be redacted when the database is dumped for testing.
- `template` - Instead of the existing `subject` field, we should have a foreign key to the email template record, so we can have access to all of the information stored there, not just `subject`.
- `body` - We should store the actual text of the email that we have sent, which will aid in debugging incorrect data substitution. This should be redacted when the database is dumped for testing.