fix(admin): a forced password change cannot trap a user or be skipped with a token

- The administrator's password form took "password-based
  authentication: Disabled" with "must change it at the next login":
  the change form asks for the old password, which the user then never
  had, so they could not get past it. That combination is refused, and
  an administrator cannot disable their own password.
- A user who must change the password could still use the API with
  their tokens. A token is now refused until they change it, as the
  pages are.

admin/views.py

@@ -187,7 +187,11 @@ def user_update_password(request, pk):
     user = get_object_or_404(User, pk=pk)
     if request.method == "POST":
         form = forms.AdminPasswordForm(user, request.POST)
-        if form.is_valid():
+        valid = form.is_valid()
+        if valid and user == request.user and not form.cleaned_data["set_usable_password"]:
+            form.add_error(None, OWN_ACCOUNT)
+            valid = False
+        if valid:
             with audit(request, None, f"User {user.username}", "set password"), transaction.atomic():
                 user = form.save()
                 UserAttributes.objects.update_or_create(