FINERACT-2003: Enforce password reset on first login

[DeathGun44]

Description

Implemented FINERACT-2003: Enforce password reset on first login.
This PR adds a configurable policy forcing users to change their password upon first login or after an admin reset.

Key Changes

• Database: Added password_reset_required column to m_appuser. System user mifos is explicitly exempted.
• Configuration: Added force-password-reset-on-first-login global flag.
• Security: Implemented PlatformUserDetailsChecker to enforce the check post-authentication, replacing custom DaoAuthenticationProvider inheritance.
• Logic:
  • Trigger: Flag set to true on User Creation and Admin Password Reset.
  • Clear: Flag set to false on successful Self Password Change.
  • Loop Prevention: Logic prevents reset loops during self-updates.
• API: Throws PasswordResetRequiredException (HTTP 403) to signal the UI.

Checklist

• Write the commit message as per our guidelines
• Acknowledge that we will not review PRs that are not passing the build ("green")
• Create/update unit or integration tests
• Follow our coding conventions
• Add required Swagger annotation and update API documentation
• This PR must not be a "code dump"

Note:
I have temporarily included the fix from PR #5384 (GlobalConfigurationHelper.java) to unblock the integration tests (avoids IndexOutOfBoundsException). I will remove this file via rebase once PR #5384 is merged.

[IOhacker]

Could you please add a context for MariaDb?

[DeathGun44]

Hi Victor, thank you for the review!

I looked into this to be sure, and since the c_configuration table is defined with autoIncrement="true" in the initial schema, MariaDB and MySQL automatically handle the ID counter updates when we insert new rows.

The setval command included here is specifically to manually sync the PostgreSQL sequence, which doesn't update automatically in the same way. I believe we don't need an equivalent step for MariaDB, but please let me know if you'd prefer I handle it differently!

[IOhacker]

Thank you

[IOhacker]

LGTM

[DeathGun44]

@IOhacker I looked into the failed tests ,failures are in LoanDelayedScheduleCaptures and LoanMerchantIssuedRefund but these appear to be unrelated to the Authentication changes in this PR. could you please re-run them?