REST API endpoint for user objects does not allow setting a password

[jeremystretch]

Environment

• Python version: 3.6.9
• NetBox version: 2.9.10

Steps to Reproduce

1. Attempt to create a new user via the REST API endpoint, specifying a username and password.

Expected Behavior

The new user should be created, and authentication should be possible using the provided username and password.

Observed Behavior

The user instance is created, however the password is not set. This is because the password field has been omitted from UserSerializer. (This was not caught by the tests due to a bug identified under #5176.)

The fix for this bug is to add password to the serializer as a write-only field (since we don't want to expose password hashes externally).