…r normalizer (yoeunes)

This PR was merged into the 7.3 branch.

Discussion
----------

[Security] Fix `UserBadge` validation bypass via identifier normalizer

| Q             | A
| ------------- | ---
| Branch?       | 7.3
| Bug fix?      | yes
| New feature?  | no
| Deprecations? | no
| Issues        | -
| License       | MIT

The `UserBadge` constructor validates that the identifier is not empty and does not exceed `MAX_USERNAME_LENGTH`.

However, when using `$identifierNormalizer`, the normalized identifier is computed lazily in `getUserIdentifier()` without validation. This allows normalizers to return invalid values:

```php
// This correctly triggers a deprecation in the constructor
new UserBadge('');

// This currently bypasses validation and returns an empty string
$badge = new UserBadge('valid_input', null, null, fn() => '');
$badge->getUserIdentifier();
```

Related to #51744 and #61183

I targeted `7.3` as it introduced `identifierNormalizer`, please let me know if I should target `8.0` or `8.1` instead.

Commits
-------

e4a759d [Security] Fix UserBadge validation bypass via identifier normalizer