Account lockout via missing credential-deletion authorization

Missing authorization in Red Hat build of Keycloak allows remote authenticated users to delete password credentials through the Admin REST API. The credential-deletion endpoint omits the fine-grained reset-password permission check, so a delegated administrator with user-management access can invoke deletion despite an explicit denial. Fine-grained admin permissions must deny reset-password access; exploitation removes a user's password credential and locks that account out.