Description
Relates to #14232
After creating a test password reset for a user with email of the form user+label@host, I noticed that the password reset URL was of the form https://<coder-url>/reset-password/change?otp=<random>&email=user+label@host.
This leads to the form not working properly due to the + being interpreted as a space ( ).
We should ensure that any inputs to the password reset URL are URL-encoded.