Stop trusting the email on its own: set trustProviderEmail to false so
email_verified is required, and additionally require the "xms_edov"
claim, which Azure sets only after verifying the issuing tenant owns
the email's domain. A token that lacks it is rejected before any
identity is matched.
Signed-off-by: Sacha Al Himdani <sacha@probo.com>
54c055ebcc