Move password reset code to AuthenticationSubsystem

[battermann]

https://wearezeta.atlassian.net/browse/WPB-8890

Checklist

• [x] Add a new entry in an appropriate subdirectory of changelog.d
• [x] Read and follow the PR guidelines

[fisx]

one more failure (flake? unrelated? serious?) -

      failure - invalid signature:                                                                   FAIL
        Exception: Error executing request: token invalid
        CallStack (from HasCallStack):
          error, called at test/integration/API/OAuth.hs:417:26 in main:API.OAuth
        CallStack (from HasCallStack):
          error, called at src/Bilge/Assert.hs:101:18 in bilge-0.22.0-6Cxcfrpv0gi69IBgCcDsiP:Bilge.Assert
          <!!, called at src/Bilge/Assert.hs:109:19 in bilge-0.22.0-6Cxcfrpv0gi69IBgCcDsiP:Bilge.Assert
          !!!, called at test/integration/API/OAuth.hs:419:82 in main:API.OAuth
        Use -p '(!/turn/&&!/user.auth.cookies.limit/)&&/failure - invalid signature/' to rerun this test only.

[fisx]

one more failure (flake? unrelated? serious?) -

      failure - invalid signature:                                                                   FAIL
        Exception: Error executing request: token invalid
        CallStack (from HasCallStack):
          error, called at test/integration/API/OAuth.hs:417:26 in main:API.OAuth
        CallStack (from HasCallStack):
          error, called at src/Bilge/Assert.hs:101:18 in bilge-0.22.0-6Cxcfrpv0gi69IBgCcDsiP:Bilge.Assert
          <!!, called at src/Bilge/Assert.hs:109:19 in bilge-0.22.0-6Cxcfrpv0gi69IBgCcDsiP:Bilge.Assert
          !!!, called at test/integration/API/OAuth.hs:419:82 in main:API.OAuth
        Use -p '(!/turn/&&!/user.auth.cookies.limit/)&&/failure - invalid signature/' to rerun this test only.

flake!

[fisx]

integration tests run times on CI:

base line: 9:26:10-9:49:48 => ~23
this PR, last run: 13:54:41-14:15:31 => ~19

not sure how representative these figures are, but they sure don't provide cause for worry. :-)