signInWithOtp bug when using email with "+" alias

# Bug report - [ X] I confirm this is a bug with Supabase, not with my own application. - [ X] I confirm I have searched the [Docs](https://docs.supabase.com), GitHub [Discussions](https://github.com/supabase/supabase/discussions), and [Discord](https://discord.supabase.com). ## Describe the bug A user with email "example+test@domain.com" exists in auth.users. If the user attempts to login with "example@domain.com" (which *does not* exist in auth.users), supabase will still send an OTP code, allow the login, and create a new user in auth.users. Effectively, a new user is being created even though `shouldCreateUser: false`, as this is the login flow. ## To Reproduce 1. Create a user with an "+" alias, "example+test@domain.com" 2. Verify this user exists in auth.users, but the "base email" without the "+" alias does not exist. e.g. `example@domain.com` does not exist in auth.users. 3. Attempt to login, not sign up, with "example@domain.com", the base email. `shouldCreateUser: false` is set. 4. Supabase will send an OTP code, allow the login, and create "example@domain.com" in auth.users. ## Expected behavior I would expect if "example+test@domain.com" exists, attempting to login with "example@domain.com" would throw an error, and not allow the login. The fact that it allows the login, AND creates a new auth.users row, even though `shouldCreateUser: false` is unexpected behavior. In my case, it fatally breaks my app because: 1. the user created, logged in and now authenticated 2. because this was achieved via the login flow, again with, `shouldCreateUser: false`, none of the initialization logic runs that otherwise does via my signup flow, where `shouldCreateUser: true`