Function inject_password_changes 

pub fn inject_password_changes(
    changes: Vec<Change>,
    resolved_passwords: &BTreeMap<String, String>,
) -> Vec<Change>

Inject SetPassword changes into a plan for roles that declare passwords.

For newly created roles, the SetPassword is inserted immediately after the CreateRole. For existing roles with a password source, a SetPassword is appended after all creates/alters (ensuring the role exists).

This function should be called after diff() and apply_role_retirements().