(WIP) Adds rule that password not appear in a blacklist

[mrclay]

Feedback welcomed. E.g. the JS version should not block the password, right? I added a few comments to help IDE comprehension. I know this needs tests.

[ircmaxell]

I would strongly suggest not dropping down to shell for this.

First, it could expose the password to anyone on the server (watching the process list), as it's passed in an argument)

Second, it's not portable

As far as working in JS or not, it would be preferable to do so, but not necessary.

[mrclay]

Yikes I didn't know cli args were easily snooped.