Built-in email verification process for OAuth scope mapping

Since 2025.10 we no longer send the email_verified value via scope mappings: https://docs.goauthentik.io/releases/2025.10/#default-oauth-scope-mappings

This means that users now need to create a custom scope mapping for applications that require verified emails: https://docs.goauthentik.io/add-secure-apps/providers/oauth2/#email-scope-verification

It would be good if we could include an email verification system out of the box so that users don't need to configure this themselves.

Linked to: https://github.com/goauthentik/authentik/issues/4097

Start with the linked issue #4097 and the referenced 2025.10 release note and OAuth email-scope documentation to understand the removal and current custom-scope workflow. Define the intended built-in verification behavior and its acceptance criteria before locating the affected OAuth scope-mapping entry points; done means applications can obtain verified-email data without custom configuration.

Written by the indexing model from the issue text.