Treat widget submissions as anonymous

[bjarn]

Summary

• Stop using an unsigned widget email address as account identity.
• Create widget feedback without a user assignment or automatic vote.
• Keep the current request fields for compatibility.
• Add regression tests for account assignment, votes, and activity attribution.

Security impact

A caller could submit an existing account email and create feedback, votes, and activity under that account.

Tests

• php artisan test --compact tests/Feature/Widget/WidgetTest.php