fix: only remove password reset scope on cred update

[BruceMacD]

Summary

When a credential is update the access key needs to have the "password reset required" scope removed, but keep the ability to create access keys. This change ensures that the key has the only the "password reset required scope" removed so any scopes we add in the future will also continue to work.

Checklist

• Wrote appropriate unit tests
• Considered security implications of the change
• Updated associated docs where necessary
• Updated associated configuration where necessary
• Change is backwards compatible if it needs to be (user can upgrade without manual steps?)
• Nothing sensitive logged
• Considered data migrations for smooth upgrades

Related Issues

Resolves #3348

[dnephin]

LGTM!