Fix account sign up cancellation

[mitchellhenke]

This PR is the intersection of a couple things. Initially, the goal was to continue reducing the number of DeprecatedUserAttributes and I noticed the only place the confirmation_token on the users table was being directly queried was when cancelling account sign up. The column is already unused and null, meaning the account cancellation was not working as intended. There is also a bit of crossover with #6247 (where we were not properly validating the email confirmation token).

The combination of problems resulted in a few changes:

1. Fixing the account cancellation to read the confirmation token from EmailAddress instead of User
2. Adding proper validation to ensure we don't delete accounts based on on invalid token
3. Moving the deletion route into the same controller as the route that renders the deletion form (with backwards compatibility)
4. Removing all uses of confirmation_token and confirmation_sent_at on the users table. The tests were a bit tricky in this regard since they depended on the EmailAddressCallback functionality to copy those attributes from the User model to EmailAddress.

[zachmargolis]

LGTM