Revoke a user's own Sanctum tokens, never another model's

[imanimanyara]

SanctumTokenIssuer::revokeAll(), called on every password reset and
update, queried the token table by a morph type taken from configuration
instead of the user's own. A second token-bearing model with a colliding
id (an Admin with id 5) therefore revoked User 5's tokens and kept its
own. It also queried that table for user models that hold no Sanctum
tokens, so a reset failed where the table does not exist.

Revoke through the user's own tokens() relation, and only for models
that use Sanctum's HasApiTokens: the behaviour before the registry, now
scoped to the Sanctum issuer so Passport's tokens stay with its own.
Restores the rationale for the ability and expiry defaults that the move
into SanctumTokenIssuer dropped. Three tests, two failing before.

[gitguardian]

️✅ There are no secrets present in this pull request anymore.

If these secrets were true positive and are still valid, we highly recommend you to revoke them.
While these secrets were previously flagged, we no longer have a reference to the
specific commits where they were detected. Once a secret has been leaked into a git
repository, you should consider it compromised, even if it was deleted immediately.
Find here more information about risks.

---

^{_{🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.}}

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.