User reference in password reset entity

As discussed on IRC, it makes no sense to directly store the email address of a user in a password reset request. Instead, it makes sense to have a user object being reference, and therefore the password requests being cascade-deleted.

This PR fixes that by introducing the user repository interface, a user repository implementation via composition and modifying the password repository implementation.