CVE-2026-113733: Password hash disclosure to "view only" admin users with custom user models

Admin users with the view (but not change) permission to a user model were

displayed the entire password hash when the model was not `AUTH_USER_MODEL`,
or when `AUTH_USER_MODEL` inherited its `password` field from a concrete
parent model through multi-table inheritance.

Thanks to Aaron chen for the report.

This issue has severity "low" according to the [Django Security Policy](https://docs.djangoproject.com/en/dev/internals/security/#security-issue-severity-levels).