fix: "Allow Password Change for OAuth Users" setting is not honored in the "Forgot Password" flow (#32398)