Add a "Reset local password" option to the authentication flow selector

Currently, the way for a user to change their local password in case they forgot it is to log in with device code flow again. However, it is a bit surprising to users that they are prompted to create a new local password in that case. We should add a separate "Reset local password" option, and make the "normal" device code flow not prompt for a new password (#369).

## Proposed behaviour

Add a "Reset local password" option to the authentication flow selector. Selecting it still requires the user to authenticate via one of the enabled auth flows (device auth or Entra password + MFA). After successful authentication the user is then asked to set a new local password.

Concretely:

1. User selects "Reset local password" from the auth mode list.
2. The user is presented with the available authentication flow and must successfully authenticate via one of them. If there is only one authentication flow, it is auto-selected.
3. Optionally prompt: *"Enter your current local password (leave blank to skip)"* — this is used to supply `PAM_OLDAUTHTOK` so `pam_gnome_keyring` can re-key the default keyring instead of orphaning it.
4. Prompt for new local password (entered twice for confirmation).
5. Store the new password hash; return `AuthGranted` with the new password as `PAM_AUTHTOK` and, if the old password was provided, the old one as `PAM_OLDAUTHTOK`.

## Related

- #369 (device code flow no longer prompts for new local password when one already exists)
- #1683 (Entra password flow silently overwrites existing local password)

Start at the authentication flow selector and trace the existing device code and Entra password + MFA flows. Read related issues #369 and #1683 for expected interactions, then verify that the new option authenticates the user, optionally accepts the old password, stores a confirmed new password, and returns the specified authentication tokens.

Written by the indexing model from the issue text.