The virtual UpdatePasswordHash is only invoked by ResetPasswordAsync

### Is there an existing issue for this?

- [x] I have searched the existing issues

### Describe the bug

We have made an override of UpdatePasswordHash, but it turns out it is only invoked by ResetPasswordAsync. For all other operations (CreateAsync, AddPasswordAsync, CheckPasswordAsync, RemovePasswordAsync) the private implementation with a password store is invoked. From an API perspective this is a very strange behavior since we had expected all updates of password hashes to use our override.

Our end goal was actually to extend the ValidatePasswordAsync method but it isn't virtual.

### Expected Behavior

The protected virtual UpdatePasswordHash should be called so the customized logic is used for all operations and not only one. All operations should behave in the same way.

### Steps To Reproduce

Make a custom UserManager class that derives from the built-in. Override the UpdatePasswordHash method and add some custom logic. This logic will only be invoked when resetting passwords and never in any other situation.

### Exceptions (if any)

_No response_

### .NET Version

.NET 6, 7, 8 and 9

### Anything else?

Somewhat related to https://github.com/dotnet/aspnetcore/issues/12344

Start by tracing UserManager's CreateAsync, AddPasswordAsync, CheckPasswordAsync, RemovePasswordAsync, and ResetPasswordAsync paths, focusing on calls to UpdatePasswordHash and ValidatePasswordAsync. Compare which implementation each path invokes and add coverage for the expected consistent behavior; done means customized password-hash logic is used for all relevant operations.

Written by the indexing model from the issue text.