No permission exists to allow a user to reset other user's passwords without also being able to set the user's password directly

I'd like to be able to configure an "operator" role in authentik such that the operator can reset another user's password (i.e. either send a recovery email, or generate a recovery link) without being able to _set_ the user's password directly.

Having looked through the authentik source code, it appears that such a configuration is not possible right now – the `authentik_core.reset_user_password` permissions is checked in all three API endpoints.

Would the authentik team be open to splitting the `authentik_core.reset_user_password` permission into two separate permissions? Perhaps `authentik_core.reset_user_password` and `authentik_core.set_user_password`?

I realise that by virtue of being able to generate a recovery link, a malicious "operator" in this example would be able to go through the recovery flow themselves and set the user's password. In my use case, I don't have any expectation of increased security, I am mostly trying to discourage / prevent accidental usage of the "set password" feature in favour of the recovery flow.