[5.x] Enable copy_reset_password_link for users with editPassword permission

[el-schneider]

I've discovered an undocumented and likely forgotten feature. Since it would be useful for a project of mine, I propose reactivating it.

I noticed it was disabled some time ago due to a security concern: #9390.

I believe the security issue might have been that a user with the sendPasswordReset permission could elevate their privileges by copying the reset link from a higher-ranking user. However, I can't identify any functional difference for users with editPassword permissions, so I guess we can "safely" activate it for users with such permissions. It also arguably way safer, than sending one-time passwords around.

[jasonvarga]

Without getting too far into the details, this security issue remains, so we won't be bringing it back.

The person clicking on the "copy password reset link" action willingly isn't the problem. If XSS managed to get injected somehow, this action's endpoint's response - which contains the password reset url - was the problem.