user: password change: require confirmation-password parameter

user: password change: require confirmation-password parameter

Add a new 'confirmation-password' parameter to the change-password
endpoint and require non-root users to confirm their passwords.

Doing so avoids that an attacker that has direct access to a computer
where a user is logged in to the PVE interface can change the password
of said user and thus either prolong their possibility to attack,
and/or create a denial of service situation, where the original user
cannot login into the PVE host using their old credentials.

Note that this might sound worse than it is, as for this attack to
work the attacker needs either:
- physical access to an unlocked computer that is currently logged in
  to a PVE host
- having taken over such a computer already through some unrelated
  vulnerability

As these required pre-conditions are pretty big implications, which
allow (temporary) access to all of the resources (including PVE ones)
that the user can control, we see this as slight improvement that
won't hurt, might protect one in some specific cases that is simply
too cheap not to do.

For now we avoid additional confirmation through a second factor,
as that is a much higher complexity without that much gain, and some
forms like (unauthenticated) button press on a WebAuthn token or the
TOTP code would be easy to circumvent in the physical access case and
in the local access case one might be able to MITM themselves too.

Reported-by: Wouter Arts <security@wth-security.nl>
Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
 [ TL: extend commit message ]
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>