restricting registration with email regex prevents adding/verifying nonconforming addresses after the account exists

This issue has been migrated from [#8696](https://github.com/matrix-org/synapse/issues/8696).

---

### Description

If `registrations_require_3pid` and `allowed_local_3pids` is set in order to restrict new user registration to known domains, all other SMTP events fail for existing users.

### Steps to reproduce

- enable `registrations_require_3pid` and set `allowed_local_3pids` to be restrictive regex
- create a local account via shared token/synapse-admin
- log in as new local account
- attempt to add an email address that does not conform to the `allowed_local_3pids` format

Expected behavior would be that, because the user account was already created externally, the user should be able to add any email address (e.g. work and personal). Only registration of new accounts should be restricted in order to prevent spam account creation.

Instead, users are unable to add a non-conforming address to their account. If an administrator adds their address for them, they cannot use that address for password-reset purposes because the server refuses to send the email.

### Version information

- **Homeserver**: jobmachine.org

If not matrix.org:

- **Version**: 1.21.2

- **Install method**: official docker container

- **Platform**: linux VPS

Start by reproducing the issue with registrations_require_3pid and a restrictive allowed_local_3pids regex, then trace the registration, email-address addition, and password-reset flows. Done means the regex still restricts new account registration while existing externally created users can add nonconforming addresses and use them for password resets.

Written by the indexing model from the issue text.