users: use sudo mode when changing email addresses.

When a user tries to change their email, redirect them to the confirm
password page (like Github's sudo mode) instead of having them re-enter
their password on the change email page. This is the same thing we do
when a user updates their API keys. This way we have can use the same
confirm password authentication flow for everything that needs a
password.

test/factories/email_address.rb

@@ -2,5 +2,6 @@ FactoryBot.define do
   factory(:email_address) do
     address { FFaker::Internet.email }
     is_verified { true }
+    user
   end
 end