Add config whether update password is allowed with register operation

[chfoidl]

Currently the UpdatePasswordResource allows updating a user's password directly via the Verification API for the register and the set-password operations.

To minimize potential attack surface, updating the password via the register operation should be configurable so it can be disabled if a password is not set when registering new user accounts.