(aws-cognito): User created in console unable to reset password

### What is the problem?

`FORCE_CHANGE_PASSWORD` flow for console created user redirects to error page.

Given:
- User pool created via AWS cdk
- User created in console
- User Account status in `FORCE_CHANGE_PASSWORD`

### Reproduction Steps

Deploy cdk stack below then follow:

1. Navigate to cognito user pool
2. Create user manually
3. Navigate to hosted UI
4. Sign in with user created
5. Go through reset password flow
6. Error is thrown
7. Password is not reset

test.py
```py
import os
from aws_cdk import (

aws_lambda as lambda_,
aws_cognito as cognito

)
from aws_cdk import core as cdk
from aws_cdk.aws_apigatewayv2_integrations import HttpLambdaIntegration
from aws_cdk.aws_apigatewayv2_authorizers import HttpLambdaAuthorizer, HttpLambdaResponseType
from aws_cdk.aws_apigatewayv2_integrations import HttpUrlIntegration
from constructs import Construct

class testStack(cdk.Stack):

def run_stack(self):

current_account = os.environ['CDK_DEFAULT_ACCOUNT']
current_region = os.environ['CDK_DEFAULT_REGION']

token_generattion_trigger_function_arn = "arn:aws:lambda:{}:{}:function:{}".format(current_region,current_account,"lambda-token-trigger")
token_generattion_trigger_function = lambda_.Function.from_function_arn(self,id="found-function-Pre-Token",function_arn=token_generattion_trigger_function_arn)

sign_in_aliases_config = cognito.SignInAliases(
username=True,
email=True,
phone=True)
password_policy_config = cognito.PasswordPolicy(
min_length=10,
require_lowercase=True,
require_uppercase=True,
require_symbols=True,
require_digits=True,
temp_password_validity=dk.Duration.days(7)
)

account_recovery_config=cognito.AccountRecovery.EMAIL_ONLY

standard_attributes_config = cognito.StandardAttributes(
email = cognito.StandardAttribute(
required=True,
mutable=False
),
family_name = cognito.StandardAttribute(
required=True,
mutable=False
),
given_name = cognito.StandardAttribute(
required=True,
mutable=False
)
)

user_pool_config = cognito.UserPool(
self,
id="test-user-pool-id",
user_pool_name="test-user-pool-name",
sign_in_aliases = sign_in_aliases_config,
password_policy = password_policy_config,
self_sign_up_enabled=True,
account_recovery = account_recovery_config,
sign_in_case_sensitive = True,
standard_attributes = standard_attributes_config,
removal_policy=cdk.RemovalPolicy.DESTROY,
lambda_triggers=cognito.UserPoolTriggers(
pre_token_generation=token_generattion_trigger_function
)

)

callback_urls = "https://example.com"

user_pool_client = cognito.UserPoolClient(self, "Client",
user_pool=user_pool_config,

generate_secret=True,
auth_flows=cognito.AuthFlow(user_password=True),
o_auth=cognito.OAuthSettings(
flows=cognito.OAuthFlows(
implicit_code_grant=True
),
scopes=[cognito.OAuthScope.EMAIL],
callback_urls=callback_urls
)
)
user_pool_domain = cognito.UserPoolDomain(self, "Test-user-pool-domain",
user_pool=user_pool_config,
cognito_domain=cognito.CognitoDomainOptions(domain_prefix="test123456789qwerty"))
```

app.py
```py
import os
from aws_cdk import core as cdk
from cdk.aws_modules.Cognito_test.test import testStack as test

def currentAccount():
return os.environ['CDK_DEFAULT_ACCOUNT']

def currentRegion():
return os.environ['CDK_DEFAULT_REGION']

def getStackEnvironment():
return {'account': currentAccount(),'region': currentRegion()}

app = cdk.App()
environment = getStackEnvironment()

if __name__ == "__main__":

test(scope=app, id="test-stack-id-cognito",env=environment).run_stack()

app.synth()

```

### What did you expect to happen?

After filling out the password reset form, password is reset and user can log in with new credentials.

### What actually happened?

Password is not reset, user cannot log in. Redirected to error page.

### CDK CLI Version

2.8.0 (build 8a5eb49)

### Framework Version

_No response_

### Node.js Version

v14.17.3

### OS

MacOS

### Language

Python

### Language Version

Python 3.9.8

### Other information

_No response_

Start by deploying the reproduction in test.py and app.py with CDK CLI 2.8.0, then repeat the Cognito hosted UI password-reset flow for a console-created user in FORCE_CHANGE_PASSWORD. Compare the failing flow with the expected successful login and trace the AWS CDK Cognito configuration involved; done means the password is reset and the user can log in without the error-page redirect.

Written by the indexing model from the issue text.