Set autocomplete property on login form fields

[bx80]

Description:

This PR sets autocomplete='current-password' for the password field and autocomplete='username' for the userlogin field on the main Matomo login page as the missing property sometime gets flagged as a security risk by security software.

Based on this this comment from a previous issue we should have autocomplete property set on all password fields.

Fixes #22020

Review

• Functional review done
• Potential edge cases thought about (behavior of the code with strange input, with strange internal state or possible interactions with other Matomo subsystems)
• Usability review done (is anything maybe unclear or think about anything that would cause people to reach out to support)
• Security review done
• Wording review done
• Code review done
• Tests were added if useful/possible
• Reviewed for breaking changes
• Developer changelog updated if needed
• Documentation added if needed
• Existing documentation updated if needed

[michalkleiner]

My only concern would be password managers. If they still work as expected with this change then I'm happy to merge this. If this prevents autofill by password managers then I would rather document this as an exception.

[bx80]

My only concern would be password managers. If they still work as expected with this change then I'm happy to merge this. If this prevents autofill by password managers then I would rather document this as an exception.

Absolutely, either outcome would be good 👍
Based on older tickets I suspect this issue might have had some prior discussion, maybe @sgiehl can shed some light on any previous decisions? 😃

[sgiehl]

Not sure, why the autocomplete attribute is missing on the login form. I was pretty sure that this would already be the case.
Anyway, looking at other big sites like GitHub, Wikipedia or Google it seems like they are setting autocomplete='current-password' and autocomplete='username' on the login forms. So maybe we should go with this as well?

[github-actions]

This issue is in "needs review" but there has been no activity for 7 days. ping @matomo-org/core-reviewers