Mail address of users is now changable in the user management

* introduced new route settings/users/{id}/mailAddress
* kept old responses
* better error messages
* dropped lostpassword.php from settings/ajax
* cleaned up the UserList.add() and hand in user object instead of
  each attribute as another parameter

fixes #12595
ref #12620 

cc @blizzz @DeepDiver1975 @PVince81 @LukasReschke 
I believe this controller can also be called by a regular user - right? 

If so you might need to add `@NoSubadminRequired` as I added a middleware for the settings that also should check for subadmin rights.