Allow the master key to bypass email verification

New Feature / Enhancement Checklist

• I am not disclosing a vulnerability.
• I am not just asking a question.
• I have searched through existing issues.

Current Limitation

Currently email verification is either off, or Parse sends verification emails each time a user signs up or changes their email address.
Our team has a custom way of onboarding users, where they verify their email addresses out-of-band.
We would like the master key to be able to bypass email verification, suppress the sending of the verification email, and mark Parse users as emailVerified=true.

Feature / Enhancement Description

Signup requests as well as modifications to existing users where the email address is changed should not lead to a new email verification sequence, provided that the caller is the master key and the requests also sets the emailVerified field to true.

Example Use Case

1. An existing user invites a new user to their organization
2. Business logic sends an invitation email
3. When a link in the email is clicked, a cloud function creates a Parse user for the email that is a member of the organization to which they were invited, without sending an additional verification email.

Alternatives / Workarounds

Turning off email verification for all users, implementing custom email verification logic.

3rd Party References

Start by tracing the signup request path and existing-user email-change handling in Parse Server, focusing on how master-key requests and the emailVerified field are processed. Check the open linked pull request before starting. Done means qualifying master-key requests can set emailVerified=true without starting or sending a verification sequence, while other requests retain current behavior.