put block around main_vendor js in main_django.html

should be a no-op for edx-east, but allow edx-west to remove
vendor.js in our password_reset_confirm.html to fix a bug
copy over password_reset_confirm.html back from master

because we've moved our password_reset_confirm.html into the theme repo.
This reduces edx-west diff with master.