user.php errors should use wp_lostpassword_url()

[lwitzel]

Error messages generated in the user.php file has the lost password url hard-coded, rather than referencing wp_lostpassword_url(). This means a developer cannot override the default lost password url in this messaging, even when adding a filter for lostpassword_url.

There are two locations with the URL hard-coded: lines 91 & 112.

[kawauso]

#18808