Account takeover via password changes without re-authentication

Missing re-authentication in YugabyteDB Anywhere allows remote authenticated users on the local network to take over accounts. The legacy change_password and update_profile handlers accepted a new password without validating the current password; the replacement reset_password handler performs that check. Exploitation requires a compromised application session with access to the account-management interface and permits password or email changes that transfer control of the account.