With protocol plugins such as mqtt, or stomp, when
they accept an incoming connection, immediately after,
an internal amqp connection is created and the credentials received
during the initial connection are passed to the internal amqp
connection.

With AMQP 1.0 plugin things are different. It only creates
an internal amqp connection when a session is created.
However, the full credentials, i.e. username and password are
received during the initial connection establishment phase.
During that phase the user is authenticated and its username is
kept in User record.
However, when a session is established and the plugin has to create
an internal amqp connection, given that we are using Oauth2 backend,
we still need to pass around the token as password. However, at this
point we no longer have it.

Therefore, to have to preserve the password. This PR suggests to
optionally keep the token in the password attribute of the #user record
and #auth-user record for auth backend which are token based such as
oauth2. Other backend such as internal, http or ldap, do not need to
preseve the initial password because to authenticate the internal
amqp connection, they support "password-less" authentication, i.e. they
only check the user exists.

Bumps [docker/build-push-action](https://github.com/docker/build-push-action) from 2 to 4.
- [Release notes](https://github.com/docker/build-push-action/releases)
- [Commits](docker/build-push-action@v2...v4)

---
updated-dependencies:
- dependency-name: docker/build-push-action
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>