Refactor ApiUserService to separate authentication vs authorization related methods

[emyl3]

Background

This was created from a discussion on #8030's PR review.

ApiUserService is getting unwieldy. We should refactor this class so that authentication and authorization concerns are separated out.

Change requested

Refactor the ApiUserService class so that any methods related to authentication (resetting emails, passwords, etc...) are separate from authorization flows (getting orgRoles etc, which have been introduced thanks to the Okta migration work).

Acceptance criteria

• ApiUserService is refactored so that
  • authentication flows are separate from authorization flows

Dependencies

• Completion of Initiate rolling migration, phase 2 #7598

Open questions

• N/A

Notes

• N/A

Additional context

• N/A