Let admins invalidate the password of selected users

[Marc-Andrieu]

Description

Summary

Let admins to mark a range of users with a stamp to compel them to change their password, effectively making a password change campaign.
This changes in the logic for password modification (no putting the same) and on authorization (authentication should instead lead saying that yes we know it's [probably] you but we don't authorize, you need to change the password)

Changes Made

• Add boolean column should_change_password in CoreUser, not nullable, default false
• Add endpoint to let an admin set should_change_password for one user
• Disable resetting the password with a flow different from re-validating the email address
• Do something to not authorize: the POST /auth/authorize redirects to the page to reset the password
• Revoke tokens

Details

Type of Change

• 🐛 Bug fix (non-breaking change which fixes an issue)
• ✨ New feature (non-breaking change which adds functionality)
• 🔨 Refactor (non-breaking change that neither fixes a bug nor adds a feature)
• 🔧 Infra CI/CD (changes to configs of workflows)
• 💥 BREAKING CHANGE (fix or feature that require a new minimal version of the front-end)

Impact & Scope

• Core functionality changes
• Single module changes
• Multiple modules changes
• Database migrations required
• Other

Testing

• Added/modified tests that pass the CI
• Tested in a pre-prod
• Tested this locally

Documentation

• Updated docs accordingly (docs.myecl.fr) :
• Code includes docstrings
• No documentation needed
• Inline comments

[codecov]

Codecov Report

❌ Patch coverage is 72.00000% with 7 lines in your changes missing coverage. Please review.
✅ Project coverage is 84.84%. Comparing base (dfc6359) to head (2c53461).

Files with missing lines	Patch %	Lines
app/core/users/endpoints_users.py	69.56%	7 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #879      +/-   ##
==========================================
- Coverage   84.86%   84.84%   -0.03%     
==========================================
  Files         199      199              
  Lines       14094    14110      +16     
==========================================
+ Hits        11961    11971      +10     
- Misses       2133     2139       +6     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Marc-Andrieu]

Missing:

• Discuss the business logic of this PoC with whomever wants
• CalypSSO minor release to have the current Hyperion tests pass again
• Add a new set of Hyperion tests to ensure the strong constraints on a known compromised account are correctly enforced and don't allow a pirate to get authorization nor change the password without having access to the emails.
• Lengthen a bit the docstrings of some endpoints in the core to account for the flow regarding a supposedly compromised account

[Marc-Andrieu]

Back-end of aeecleclair/CalypSSO#189