keycloak: Add "Well-Known URL for Changing Passwords"[1]

More and more browsers and password managers support this[2].

[1] https://w3c.github.io/webappsec-change-password-url/
[2] https://github.com/w3c/webappsec-change-password-url/issues/16

roles/keycloak/templates/nginx.d.conf.j2

@@ -28,6 +28,11 @@ server {
 
     root {{ keycloak_domain }};
 
+    # https://w3c.github.io/webappsec-change-password-url/
+    location /.well-known/change-password {
+        return 302 https://$server_name/auth/realms/archlinux/account/#/security/signingin;
+    }
+
     location ~ /auth/realms/[a-z]+/metrics  {
         auth_basic "Prometheus exporter";
         auth_basic_user_file {{ keycloak_nginx_htpasswd }};