Idea from Matthew Holt, using the haveibeenpwned API to query
whether a password has been found in a data-breach.

Signed-off-by: Alex Ellis (VMware) <alexellis2@gmail.com>