Add email_access_valdiated_at field to user table, populate it

and update it when users have to use their email to interact with
Notify service.

Initial population:
If user has email_auth, set last_validated_at to logged_in_at.
If user has sms_auth,  set it to created_at.

Then:
Update email_access_valdiated_at date when:
- user with email_auth logs in
- new user is created
- user resets password when logged out, meaning we send them an
email with a link they have to click to reset their password.

tests/app/db.py

@@ -82,7 +82,7 @@ def create_user(
     user = User.query.filter_by(email_address=email).first()
     if not user:
         user = User(**data)
-    save_model_user(user)
+    save_model_user(user, validated_email_access=True)
     return user