Check passwords against HaveIBeenPwned

[jolheiser]

This PR implements a way to check a password against HaveIBeenPwned.

Something to note, I made a decision to add padding to all requests for extra security. Since we are using the service solely to check passwords for a user (vs some automated security script), the added overhead should be fairly negligible.

You can read more about HaveIBeenPwned's padding here: https://haveibeenpwned.com/API/v3#PwnedPasswordsPadding

[jolheiser]

@mrsdizzie Done. I also added the link to the admin command.

[codecov-commenter]

Codecov Report

Merging #12716 into master will decrease coverage by 0.00%.
The diff coverage is 10.81%.

@@            Coverage Diff             @@
##           master   #12716      +/-   ##
==========================================
- Coverage   43.25%   43.24%   -0.01%     
==========================================
  Files         648      649       +1     
  Lines       71928    72000      +72     
==========================================
+ Hits        31111    31137      +26     
- Misses      35775    35819      +44     
- Partials     5042     5044       +2     

Impacted Files	Coverage Δ
cmd/admin.go	0.00% <0.00%> (ø)
routers/api/v1/admin/user.go	16.02% <0.00%> (-1.46%)	⬇️
routers/user/setting/account.go	26.04% <0.00%> (-0.85%)	⬇️
routers/admin/users.go	25.71% <5.55%> (-1.89%)	⬇️
routers/user/auth.go	11.59% <5.55%> (-0.12%)	⬇️
modules/password/pwn.go	37.50% <37.50%> (ø)
modules/password/password.go	70.83% <50.00%> (-2.50%)	⬇️
modules/setting/setting.go	47.61% <100.00%> (+0.11%)	⬆️
modules/indexer/stats/db.go	43.47% <0.00%> (-17.40%)	⬇️
modules/indexer/stats/queue.go	64.70% <0.00%> (-11.77%)	⬇️
... and 13 more

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update bea343c...ab26504. Read the comment docs.

[jolheiser]

@lafriks Let me know if you still think they should be changed, but for the moment I've resolved the issues as HIBP capitalizes the URL part.

[mrsdizzie]

lgtm -- also wouldn't mind this being in 1.13 as a better alternative to the password complexity feature : )