ui/user: Allow setting/changing basic auth passwords in UI

[allending313]

• Identified the issue which this PR solves.
• Read the CONTRIBUTING document.
• Code builds clean without any errors or warnings.
• Added appropriate tests for any new functionality.
• All new and existing tests passed.
• Added comments in the code, where necessary.
• Ran make check to catch common errors. Fixed any that came up.

Description:
Provides a way for users and admins to reset a basic auth password through the UI.

• Updated the edit user detail modal to support resetting a password.
• The edit detail button will be available to non-admin users when viewing their own user profile page (edit role checkbox will be unavailable if they are not an admin).
• Admins will be able to update users' passwords without needing to enter the user's old password.

Which issue(s) this PR fixes:
Fixes #2667

Out of Scope:
Forgot password feature

Screenshots:
Non-Admin view

Admin view

Describe any introduced user-facing changes:

• Updated user edit details modal to support resetting password.
• Slightly refactored user profile page option buttons (delete, edit, favorite)

Describe any introduced API changes:

• Created gql endpoint to update user password

[AlaricWhitney]

@allending313 it looks like there's some conflicts that need to be resolved.

[mastercactapus]

The code looks good. Functionally validated and seeing a couple of issues to address:

• if Auth.DisableBasic is set, this form should be disabled with a message (e.g., "password authentication is currently disabled")
• It might be a good idea to require oldPassword for the current user, even if they are admin
• user accounts created via OIDC or GitHub (i.e., no entry in auth_basic_users) don't get one set by admin -- "succeeds" but basic auth doesn't work for the user
• user accounts created via OIDC or GitHub (i.e., no entry in auth_basic_users) get an invalid ID when trying to set it for themselves

[allending313]

for accounts created via OIDC/Github, should we hide the pw reset fields for those user accounts? (not quite sure how to check for account creation method)
or should the backend check for this and return an error message if users try to reset the pw for an account not created via basic auth (entry not found in auth_basic_users)

[mastercactapus]

@allending313 Based on recent discussions, disable rather than hide. It tends to be confusing when pieces of the UI are missing entirely. A little text about why it's disabled would also probably help.

I'm thinking maybe we can add a hasPassword to the User type, which is only accessible to the current user, or an admin, and in the case of hasPassword === false, then we'd hide the "Old password" field and not require it.

We just need to be sure that while an admin can "upsert" a new password, a user can only update an existing one if the old password is specified.

[andrewbenington]

What is the Username field used for? it doesn't seem to correspond to the display name or email

[allending313]

What is the Username field used for? it doesn't seem to correspond to the display name or email

The Username field is there for admins to create a basic auth AuthSubject for a user. Normally when a user already has basic auth as an AuthSubject, the pw reset feature would just update that basic auth password. However, if they don't already have an existing basic auth AuthSubject we want admins to have the ability to create one for the user which requires a username for login.