MM-32013: Do not allow password change in /auth endpoint (#16770)

We were allowing new password to be reset without asking
for the old password. This was not advertised but was possible nevertheless
through the API.

Since there is already a separate API to change password, we choose to remove
this functionality.

https://mattermost.atlassian.net/browse/MM-32013

```release-note
The /api/v4/users/me/auth API endpoint cannot be used to change password anymore.
This was a hidden feature that was not documented, but was nevertheless possible.
We are just removing the hidden feature.
```

Co-authored-by: Mattermod <mattermod@users.noreply.github.com>

model/user.go

@@ -126,7 +126,7 @@ type UserPatch struct {
 }
 
 type UserAuth struct {
-	Password    string  `json:"password,omitempty"`
+	Password    string  `json:"password,omitempty"` // DEPRECATED: It is not used.
 	AuthData    *string `json:"auth_data,omitempty"`
 	AuthService string  `json:"auth_service,omitempty"`
 }