Avoid duplicate Arkose verify call for mixed-case emails

What does this MR do and why?

Avoid duplicate Arkose verify call for mixed-case emails

The signup before_action memoizes the verify response under the raw email param, while record_arkose_data looks it up under the persisted user.email. Devise strips and downcases email on validation, so any address typed with uppercase or surrounding whitespace missed the memo and sent a second verify request for an already-consumed session token.

When that second request came back as an invalid token, the guard in record_arkose_data returned early, so the user was created with no arkose_risk_band and no arkose_sessions row. A missing risk band is indistinguishable from Low in new_user_required_methods, leaving the account on email-only verification.

Normalizing the address before it becomes part of the memo key collapses the two lookups into one request and sends Arkose the same address that is stored on the user.

Changelog: fixed EE: true

References

Screenshots or screen recordings

Before	After

How to set up and validate locally

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.