verifyOtp fails with otp_expired on the old email address when performing an email_change with double confirmations

# Bug report - [x] I confirm this is a bug with Supabase, not with my own application. - [x] I confirm I have searched the [Docs](https://docs.supabase.com), GitHub [Discussions](https://github.com/supabase/supabase/discussions), and [Discord](https://discord.supabase.com). ## Describe the bug When attempting to confirm an email change on both the old and new email addresses (i.e., `double_confirm_changes = true`), the verifyOtp method fails with `otp_expired` when using the 6-digit token received by the **old** email address. The method returns successfully when confirming the new email address with the token received by the **new** email address. The email change ends up being confirmed by simply executing the verifyOtp method twice for the same arguments (using the **new** email address and its respective token). ## To Reproduce 1. Ensure `double_confirm_changes = true` in Supabase servers settings 2. Ensure `email_change.html` email template displays `{{ .Token }}` 3. Perform `await supabase.auth.updateUser({email: "new@example.com"})` while logged in as a user whose email address is currently confirmed at `old@example.com` 4. Assuming 654321 is the token received by `new@example.com`, perform : ```await supabase.auth.verifyOtp({email: "new@example.com", token: 654321, type: "email_change"})``` -> SUCCESS 5. Assuming 123456 is the token received by `old@example.com`, perform : ```await supabase.auth.verifyOtp({email: "old@example.com", token: 123456, type: "email_change"})``` -> `otp_expired` error 6. The user's email address is still `old@example.com` 7. Confirm the new email address a second time ```await supabase.auth.verifyOtp({email: "new@example.com", token: 654321, type: "email_change"})``` -> SUCCESS 8. The user's email address is now `new@example.com` ## Expected behavior Verification for both old and new email addresses should succeed, and the user's email should be updated to `new@example.com` after verifying both email addresses tokens. The ema…