[Issue] Reuse password reset tokens until they expire

[m2-assistant]

This issue is automatically created based on existing pull request: #25280: Reuse password reset tokens until they expire

---

Description (*)

This avoids a race condition where email delivery is slow and user generates
new token before original (now invalid) token is received.

Consider the following scenario:

1. User requests token (1)
2. User waits, but does not yet receive the token
3. User requests another token (2)
4. User receives token (1), but this is invalid
5. User requests another token (3)
6. User receives token (2), but this is invalid
7. [repeat]

This also has the added bonus of not giving an attacker sequential tokens upon request. While the tokens are understood to be suitably opaque, any information disclosures identified in future will be at least partially mitigated by reusing the same token rather than giving out another token data point.

Fixed Issues (if relevant)

Manual testing scenarios (*)

1. Generate password reset email (admin & frontend)
2. Wait for time-out
3. Generate another password reset email
4. Observe same token in both emails

Questions or comments

I am unsure if this change requires a unit test.

Contribution checklist (*)

• Pull request has a meaningful description of its purpose
• All commits are accompanied by meaningful commit messages
• All new or changed code is covered with unit/integration tests (if applicable)
• All automated tests passed successfully (all builds are green)