Notification email updated without confirmation

Summary

When updating a GitLab user email address under /profile, confirmation is required to make the change permanent, for the main email. However the notification_email is updated instantly without confirmation. This is also not reflected in `/profile/notifications.

Steps to reproduce

1. Go to /profile
2. Update the "Email" - gitlab@example.org
3. Confirmation is now required.

Expected behavior

The notification_email is not updated until the address is confirmed.

Actual behavior

notification_email is updated.

Output

before profile change

=> #<User id: 1, email: "admin@example.com", notification_email: "admin@example.com">

after profile change

=> #<User id: 1, email: "admin@example.com", notification_email: "test@example.org">