fix: the views that take a password or a key keep it out of error reports

No view used sensitive_post_parameters, so once ADMINS is set the error
mail of a failing POST would carry the password or key in plain text.
The user create, edit and password views, the password change, the
compute forms, the host secrets, the VM's root password and its console
settings now mark their POST data sensitive.

accounts/views.py

@@ -20,6 +20,7 @@ from django.utils.http import url_has_allowed_host_and_scheme
 from django.utils.translation import gettext_lazy as _
 from django.views.decorators.cache import never_cache
 from django.views.decorators.http import require_POST
+from django.views.decorators.debug import sensitive_post_parameters
 
 from accounts.apps import admin_password_path
 from computes.utils import lock_ownership
@@ -186,6 +187,7 @@ def account(request, user_id):
     )
 
 
+@sensitive_post_parameters()
 @login_required
 def change_password(request):
     must_change = UserAttributes.objects.filter(