Provide Password (Compromised) Checking API

[rwinch]

Summary

Password reuse is a serious problem for users and the source of many different hacks. It would be awesome if we could provide integration with https://haveibeenpwned.com to alert users if their password has been compromised.

Some ideas are that this check could be automated when authenticating a user, changing a password, etc.

---

After playing a bit around the design of such API it has become clear that it should focus solely on checking if a password is compromised. It is not its intention for now to make a contextual check, like if a password has been reused for example.