Add Have I Been Pwned password requirements check

[mgaffigan]

NIST SP 800-63B §5.1.1.2 requires passwords to be checked against leak lists. This fixes that gap in OIE by adding support for checking HIBP's API. Confidentiality of the password is maintained by k-anonymity. The setting is default-enabled on new installations.

Testing can be accomplished by trying to change the password to "correct horse battery staple":

The functionality is default-disabled for upgrades, and can be enabled/disabled by setting/clearing the new password.breachedurl mirth.properties setting.

# password requirements
# ...snip...
# Check new passwords against the Have I Been Pwned range API, as recommended by
# NIST SP 800-63B (see https://haveibeenpwned.com/NIST).  Secured by k-anonymity.
password.breachedurl = https://api.pwnedpasswords.com/range/

[github-actions]

Test Results

681 tests  +6   681 ✅ +6   2m 20s ⏱️ + 1m 26s
115 suites +1     0 💤 ±0 
115 files   +1     0 ❌ ±0 

Results for commit 7385ea7. ± Comparison against base commit 423df18.

♻️ This comment has been updated with latest results.