Harden email change in IdentityApiEndpointRouteBuilderExtensions

Currently the email can be changed when the user is simply logged in. To harden this, require a current credential (step-up) before initiating an email change, mirroring the password branch. For example, gate the change by password (`OldPassword`) or valid 2FA code (when 2FA is enabled).

Something like:
```csharp
if (!string.IsNullOrEmpty(infoRequest.NewEmail))
{
var email = await userManager.GetEmailAsync(user);
if (email != infoRequest.NewEmail)
{
// Require proof of current control of the account before re-pointing the recovery channel.
if (string.IsNullOrEmpty(infoRequest.OldPassword) ||
!await userManager.CheckPasswordAsync(user, infoRequest.OldPassword))
{
return CreateValidationProblem("OldPasswordRequired",
"The current password is required to change the email address.");
}

await SendConfirmationEmailAsync(user, userManager, context, infoRequest.NewEmail, isChange: true);

// Notify the prior address so the legitimate owner can detect an unauthorized change.
await NotifyEmailChangeRequestedAsync(user, oldEmail: email, newEmail: infoRequest.NewEmail);
}
}
```