Consolidate / DRY up spam trap tests into a single spec

[lorenyu]

from the following discussion

@lorenyu non-blocking thought: i see a lot of "handles submissions by bots" tests in this PR, i wonder if it makes sense to DRY that up somehow. maybe not but just wondering

@doshitan Yea not sure, just from the upstream changes: c7e83fa

@lorenyu yeah, thinking about it more, it seems like it should be a separate spec along the lines of

# psuedocode
describe "non-logged in forms"
  parametrize on { form: ["registration", "password reset", "login"] }
  it "includes honeypot fields and logic to catch bots that spam all fields"
    navigate to form
    spam all fields
    submit
    expect response to be 422
  end
end