Remove "Forgot your password?" link on failed login attempt message if user has no access to the user password reset form

dcam → changed the visibility of the branch 11.x to hidden.

dcam → changed the visibility of the branch 3357616-remove-forgot-your to hidden.

I rebased the old MR for 11.x and added a test.

UI section should actually contain before/after screenshots.

Leaving as a bug but not 100% sure, tagging for framework manager sign off too.

Feel if this is a desired feature there probably should be a config option.

Added screenshots.

I implemented the autoconfigure option in the services file.

For what it's worth I may be -1 for this, and think it would be a feature request and probably a new configuration setting for accounts

This issue isn't particularly important to me; I'm just writing tests for issues that need tests. But for what it's worth I think it's strange idea to have a configuration setting that effectively asks admins "Do you want to prevent a link from being displayed that may lead to a 403 error page depending on your site's configuration?"

If it must be configurable, then it may be better to build the capability to turn off the password reset page directly into Core instead. That way we're checking a more well-defined feature, not building configuration whose function is difficult to articulate why an admin would want to use it.

While I might not care about this issue as stated (where the standard login form is used, but for some reason the password reset page must be disabled) being able to disable the password reset page with Core functionality is of interest to me. We use an external authentication provider at work. Since we bypass Drupal's basic auth, I had to build a small custom module to turn off the password reset route so no one tries to use it. There are contrib modules out there that do similar things, but none of them did exactly what I wanted. So this is a pretty common need for people using external auth.

Then shouldn't a configuration setting under Account settings make that easier. So you can just set it without any contrib module having to do it for you.

Yes, that's what I'm saying. But that isn't the original reason for this issue. A maintainer would need to weigh in and determine whether the issue should be refocused to do that.

I think it's fine to check access on the link before showing it in this case. We do this even in some help text pages, and for a visitor-facing string it makes even more sense. Untagging for framework manager review. Replied to one thread on the MR but don't have a strong opinion either way.

I think it's worth a follow-up issue to add a config option for the password reset page under user settings, but that could still conditionally set access on the route, so it still makes sense to check route access before displaying the link IMO - e.g. we wouldn't necessarily have to change this code, except to drop some test module code and use the user config instead.