Report invitation links not restricted to any existing user

Summary

We recently made a change to how report invitations in order to make the Disclosure Assistance process better. Parts of this change regressed the fix we made in #123420 regarding how report invitations (such as to become an external participant) are handled. @japzdivino notified of this regression and worked with us to get the logic back to the previous intent.

To correct this issue, we added logic that ties report invitation links to a user if the user exists on the platform (either the username or the e-mail address). If the invitation link was sent to an e-mail address not matching an existing user on HackerOne, any user can still consume the invitation.

We are disclosing this report under Limited Visibility due to multiple attachments and comments including e-mail addresses, as this was part of the POC.