Include an invisible username field in password change forms

[sandhose]

We had that originally in the server-side rendered password recovery form: if you include a hidden <input type="text" value="alice" autocomplete="username" /> so that password manager can detect which account the password was just changed.

This means:

• we need an anonymous GraphQL API to fetch infos about the recovery ticket
• we need to implement that on the password recovery form
• we need to implement that on the password change form (easier because we already know the user here)

[matrixbot]

For your information, this issue has been copied over to the Element fork of matrix-authentication-service: element-hq/matrix-authentication-service#3032