Password grant endpoint: do not allow authentication, when user is blocked

Before authenticating the user via username and password it should be checked if the user is blocked.

see \Drupal\user\Controller\UserAuthenticationController::login and \Drupal\user\Controller\UserAuthenticationController::userIsBlocked

    if ($this->userIsBlocked($credentials['name'])) {
      throw new BadRequestHttpException('The user has not been activated or is blocked.');
    }