Developer Portal user password change controls bypass

## Problem description
The developer portal did not expose a “Change Password” function within the graphical web interface. However, we discovered that a user’s password could be changed by directly browsing to a specific URI. This allowed users with valid sessions to change their password without knowing the current password, and without being constrained by password complexity requirements.

If an attacker is able to compromise the user's session, they can then change the user's password without knowledge of the current password and completely compromise the account.

## Affected Scope
https://prephzntzinterop.management.healthtranzformdev.com/subscriptions/xxx/resourceGroups/xxx/providers/Microsoft.ApiManagement/service/ptzio03wuhznapim/users/[USER ID]?api-version=2019-12-01

## Impact
An attacker could compromise a user's account on the developer portal. A compromise within the developer portal did not lead to a compromise of patient data

## Exploitability
An attacker would need to gain access to a valid user session via another compromise in order to have the opportunity to exploit this issue and change a user's password

## Recommendations
Update the change password function so that the user must enter their current password in order to set a new password.

##

Start by tracing the developer portal request for the affected user URI and locate the password-change flow. Review how the current password and password-complexity requirements are handled, then verify that both are enforced when changing a password. The payload does not name files or tests, so those entry points must be discovered first.

Written by the indexing model from the issue text.