Add password policy setting `suggestChangeOnLogin`

Add password policy setting `suggestChangeOnLogin`

Password policy checks that fail and have `suggestChangeOnLogin` set to true will
prompt for a password change on login.

Below are some rules that apply to this setting in different scenarios:

- If only one policy fails and has `suggestChangeOnLogin = false`, a password change will
  not be requested
- If more than one policy fails and one or more have `suggestChangeOnLogin` set to true`,
  a password change will be requested
- If `forceChange` is present in any of the failing policies, `suggestChangeOnLogin` value
  will be ignored and password change will be enforced
- if $wgInvalidPasswordReset is set to false `suggestChangeOnLogin` is ignored

IMPORTANT**
Before this patch, suggesting a password change was the default behavior (depending on
$wgInvalidPasswordReset), which means that the necessary changes to $wgPasswordPolicy
need to be in place before this patch is merged and gets to production.

Bug: T211621
Change-Id: I7a4a0a06273fa4e8bd0da3dac54cf5a1b78bb3fd