A registration token can now be marked `passwordless`, which will let the
user register without picking a password: their identity is established by
the email verification code instead.
This only adds the column and plumbs it through the storage layer, the
admin API and the anonymous `registrationToken` GraphQL query; the
registration flow itself is unchanged for now.