Word a provider account's first-password email as setting, not resetting

Since GHSA-4r8h-mwfm-f5f4, an account that signs in through a provider
gets its first password only from the reset link emailed to it. That
email said "you are receiving this because we received a password reset
request", to somebody who never had a password and may well ignore it.

ResetPasswordNotification now takes firstPassword, which
User::sendPasswordResetNotification() sets for an AuthSource::Social
account: "Set your password", what the link is for, and that nothing
changes if they did not ask. It is not taken from the customisable reset
template, whose text is written about resetting. Accounts with a password
get the reset email exactly as before.

app/Models/User.php

@@ -152,7 +152,10 @@ class User extends Authenticatable implements HasLocalePreference
      */
     public function sendPasswordResetNotification($token)
     {
-        $this->notify(new ResetPasswordNotification($token));
+        // An account that signs in through a provider has never had a
+        // password here, so its link sets the first one rather than
+        // resetting anything (PasswordController::sendLink).
+        $this->notify(new ResetPasswordNotification($token, firstPassword: $this->auth_source === AuthSource::Social));
     }
 
     /**