[BUGFIX] Fix validation and response in PasswordRecoveryController

Since the introduction of `ForwardResponse` in Extbase in #92815
password rules and hash validation in the PasswordRecoveryController
did not always lead to the expected forward of the request, since
initialize*Actions in Extbase do not handle a potential response.

This patch moves the existing validation logic to the corresponding
controller actions, so `ForwardResponse` objects can be handled
properly.

Also, all Extbase actions now return PSR-7 responses where suitable.

Resolves: #93869
Releases: master
Change-Id: Ide7877d40205f86a5a4f7bfe058857d821224438
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/69677


Tested-by: core-ci <typo3@b13.com>
Tested-by: Rudy Gnodde <rudy@famouswolf.com>
Tested-by: Christian Kuhn <lolli@schwarzbu.ch>
Reviewed-by: Rudy Gnodde <rudy@famouswolf.com>
Reviewed-by: Christian Kuhn <lolli@schwarzbu.ch>