Log if password matches current for password reset event

[aduth]

🛠 Summary of changes

Adds an event property indicating whether the password was the same as the user's current password when successfully resetting a user password.

This will be used to understand how common this behavior is, in case there's improvements we could make to this workflow, particularly for users who might be impacted by identity verification profile deactivation due to password reset.

Related Slack discussion: https://gsa-tts.slack.com/archives/C01710KMYUB/p1730231046429359

📜 Testing Plan

1. Go to http://localhost:3000
2. Create an account. Remember your password
3. Once you reach account dashboard, go to http://localhost:3000/verify
4. Complete identity verification
5. Sign out
6. Click "Forgot your password?
7. Submit the email address associated with your account
8. Click "Reset your password" in the email you received
9. Run make watch_events in a separate terminal process
10. When prompted to choose a new password, enter the same or a different password from what you know to be the user's current password
11. Observe that password_matches_existing is false if you entered a different password, or true if you entered the same password

[mitchellhenke]

This is a relatively expensive comparison, I'm not sure if we'd want to do this on every password reset going forward. It may even be desirable to feature flag it?

[matthinz]

Looks like we do roughly 100k password resets a day. If we are concerned we could capture this for a subset (5%? 10%?) and still get a meaningful result?

[aduth]

Yeah I could set this up as an A/B test to limit the performance impact, and to allow us to quickly turn it off.

However, that being said, if we ever did want to do any sort of follow-up work here (e.g. avoid deactivating profiles for unchanged password), I'm not sure there's a way around doing the check.

[aduth]

Although, in that hypothetical future, I suppose the cost of checking whether the password has changed would be offset slightly by avoiding hashing the new password when it's unchanged.