Rework session destroy into session clean

[sfritzsche]

Description (*)

Before:

The current session (incl. cart items) making a password “forget” request is destroyed as soon as a password request with a formally correct email address is received.

After:

The process is only triggered if the email address really exists. If it does, only the customer session associated with the email address is reset and not the session that “requested” it.

Fixed Issues

1. Fixes magento/magento2#39021

Manual testing scenarios (*)

1. add a product to the shopping cart.
2. start the "Forgot password" process on the "/customer/account/forgotpassword" page with a formally correct email address.
3. the product is still in the shopping cart.