Fix AZResetPassword false positives

[simondotsh]

Some roles cannot reset the password of users that either own or are members of role-assignable groups. The queries to create AZResetPassword edges have been modified to take this into account for the following roles:

• Helpdesk Administrator
• Authentication Administrator
• Password Administrator
• User Administrator

[simondotsh]

I validated the queries with a large data set, and they are far too expensive. I will reopen a pull request whenever I found a proper fix.