Fixed #23409 -- Extract PasswordResetForm.get_users method.

      Allows easier customization of policies regarding which users are allowed to
reset their password.

Thanks Aymeric for review.