Include an invisible username field in password change forms

[matrixbot]

This issue was originally created by @sandhose at matrix-org/matrix-authentication-service#3032.

We had that originally in the server-side rendered password recovery form: if you include a hidden <input type="text" value="alice" autocomplete="username" /> so that password manager can detect which account the password was just changed.

This means:

• we need an anonymous GraphQL API to fetch infos about the recovery ticket
• we need to implement that on the password recovery form
• we need to implement that on the password change form (easier because we already know the user here)