Extract password view setup behaviors from shared email confirmation behavior

[aduth]

🛠 Summary of changes

Updates shared code for email confirmation token to only be called as needed.

As mentioned in #11466, email confirmation happens across two controllers, which each individually validate the incoming confirmation token. Prior to these changes, the validation included a few things performed in both the initial email confirmation, as well as the password setup screen:

• Assigning forbidden passwords instance variable
• Flashing a success message

Since these are only relevant for the display of the password setup screen, the changes here move the code into the password setup controller.

📜 Testing Plan

Verify no regressions of expected behavior:

1. Go to http://localhost:3000/
2. Click "Create an account"
3. Enter the email address [email protected]
4. Confirm Rules of Use
5. Click "Submit"
6. In the email received, click "Confirm email address"
7. Observe success banner indicating that you've confirmed email address and need to set up password
8. Try submitting a "forbidden" password [email protected]
9. Observe that you see an error message

[aduth]

AFAICT we weren't ever using this locals assignment, since the view references @confirmation_token directly. Locals are intended to be referenced without the @.