UserAccessControlHandler has wrong $explicit_check_fields name for the password field when checking field access

Problem/Motivation

The UserAccessControllHandler::checkFieldAccess() method has a $explicit_check_fields array. This is meant to be used to blacklist fields, like password from the general admin permission. However, This is currently:

    $explicit_check_fields = array(
      'password',
    );

Oops, we don't have a field called 'password', but we do have one called 'pass'.

Proposed resolution

Change this to the correct 'pass' field name, and amend UserAccessControlHandlerTest to reflect this.

Get confirmation this IS a bug and that current tests are just playing into the hands of this bug, with the values modified to make the tests pass...?

Remaining tasks

Review of above

User interface changes

N/A

API changes

N/A