[ENG-11761] Add password length restriction (#11811)

## Ticket
https://openscience.atlassian.net/browse/ENG-11761

## Purpose
Add a password length restriction to UserResetPasswordSerializer. It should match other uses in the codebase, which looks to be a limit of 255 characters. Unrestricted user input is bad and can cause system problems.


## Changes
Add password length restriction to UserResetPasswordSerializer with 255 chars

Author: mkovalua

api/users/serializers.py

@@ -455,7 +455,7 @@ class Meta:
 class UserResetPasswordSerializer(BaseAPISerializer):
     uid = ser.CharField(write_only=True, required=True)
     token = ser.CharField(write_only=True, required=True)
-    password = ser.CharField(write_only=True, required=True)
+    password = ser.CharField(write_only=True, required=True, max_length=255)
 
     class Meta:
         type_ = 'user_reset_password'

api_tests/users/views/test_user_settings_reset_password.py

@@ -129,6 +129,28 @@ def test_post_invalid_password(self, app, url, user_one, csrf_token):
         res = app.post_json_api(url, payload, expect_errors=True, headers={'X-THROTTLE-TOKEN': 'test-token', 'X-CSRFToken': csrf_token})
         assert res.status_code == 400
 
+    def test_post_password_too_long(self, app, url, user_one, csrf_token):
+        app.set_cookie(CSRF_COOKIE_NAME, csrf_token)
+        encoded_email = urllib.parse.quote(user_one.email)
+        url = f'{url}?email={encoded_email}'
+        from tests.utils import capture_notifications
+
+        with capture_notifications():
+            res = app.get(url)
+        user_one.reload()
+        payload = {
+            'data': {
+                'attributes': {
+                    'uid': user_one._id,
+                    'token': user_one.verification_key_v2['token'],
+                    'password': 'a' * 256,
+                }
+            }
+        }
+
+        res = app.post_json_api(url, payload, expect_errors=True, headers={'X-THROTTLE-TOKEN': 'test-token', 'X-CSRFToken': csrf_token})
+        assert res.status_code == 400 and res.json['errors'][0]['detail'] == 'Ensure this field has no more than 255 characters.'
+
     def test_throttle(self, app, url, throttle_user, csrf_token):
         app.set_cookie(CSRF_COOKIE_NAME, csrf_token)
         encoded_email = urllib.parse.quote(throttle_user.email)