Application Passwords: Include siteurl in return data from auth flow.

[georgestephanis]

Rather than rely on applications to store and connect the site's url with the session the user returns to (which can be fragile with multiple concurrent blogs being connected at once) let's just pass back the url of the site that the credentials are generated for.

• Add a comment clarifying that the php code block is a fallback for no-js
• Fix username to user_login -- we've been doing the latter in practice, but some code still returned the former.
• Most relevantly, add a site_url parameter to the return data so clients have confirmation of what url they can use the returned credentials with.

Trac ticket: https://core.trac.wordpress.org/ticket/51602#ticket

I hesitate to do that as part of the goal is to be agnostic. Given the site url, the client can always determine the rest url, but the client may also want the credentials to use for xmlrpc or other systems like WPGraphQL

[TimothyBlynJacobs]

In 49291:

App Passwords: Include site_url in the success redirect payload.

Props georgestephanis.
Fixes #51602.

Good point, that makes sense.

Merged in 1e85024fb4be72eb6a1244d0c7c09590ed7172a2.

Trac ticket: https://core.trac.wordpress.org/ticket/59532

Trac ticket: https://core.trac.wordpress.org/ticket/59532