Verify emails in release metadata using PyPI user information

[facutuesca]

Part of #8635, this PR starts verifying the emails included in a release's metadata (author_email and maintainer_email) by comparing that email against the public and verified emails of the PyPI project's owners and maintainers.

If the emails match, we include the corresponding field in the "Verified details" section, under the Meta heading.

cc @woodruffw

[ewdurbin]

I'm not sure that we want to do this. Since PyPI account email addresses are private, and release metadata is public, this would act as an oracle to determine user email addresses?

We may want to limit this to the case where the user has marked an email address as public.

[woodruffw]

I'm not sure that we want to do this. Since PyPI account email addresses are private, and release metadata is public, this would act as an oracle to determine user email addresses?

Yeah, agreed -- I think a user leaving their email private is probably a strong signal that they don't want it positively identified by PyPI in a public fashion, even if it's disclosed as part of the metadata anyways.

[facutuesca]

We may want to limit this to the case where the user has marked an email address as public.

Makes sense! I changed the code so that now we verify against all emails of an owner/maintainer that are public and verified.