Enhancement: configurable Microsoft OAuth account-linking trust policy

### 🔖 Enhancement description Add an explicit **per-project, per-provider account-linking policy**, starting with Microsoft, for deployments that deliberately trust the provider-reported address when connecting an OAuth identity to an existing account. Keep the current verified-email requirement as the default. An administrator should be able to opt into a documented alternative without maintaining a modified OAuth adapter. The documentation should explain the broader trust involved, its effect on automatic linking, and any interaction with Appwrite's `emailVerification` flag. I am raising this as an enhancement because the existing restriction is intentional: [PR #10986](https://github.com/appwrite/appwrite/pull/10986) introduced the verified-email linking requirement and the generic bad-request response. ### 🎤 Pitch We encountered this while integrating Microsoft OAuth into a self-hosted **Appwrite 2.0.0** deployment at **CyberITEX**, using Next.js SSR and `createOAuth2Token` followed by `createSession`. **Observed behaviour / reproduction** 1. Have an existing active email/password account with a verified email address, such as `person@example.com`, and no linked Microsoft identity. 2. Start a new Microsoft OAuth sign-in using `createOAuth2Token`, without an existing authenticated Appwrite browser session at the native callback. 3. Authenticate with a Microsoft account for which the adapter returns the same address. 4. Appwrite redirects to the configured failure URL with `type: general_bad_request` and `code: 400`, before the application's success callback runs. Other Microsoft accounts could sign in, and Google and GitHub sign-in also worked in our testing. Those observations do not establish that every provider linked to the same Appwrite user ID. In the [2.0.0 Microsoft adapter](https://github.com/appwrite/appwrite/blob/2.0.0/src/Appwrite/Auth/OAuth2/Microsoft.php#L124), the address comes from Graph's `userPrincipalName`, while `isEmailVerified()` always re…