Refuse known-breached passwords when a password is set or reset

After OPS-41: the lists used against us were email and password pairs leaked from other services. Lockout (ENG-1702) slows an attack; refusing passwords that are already on such lists stops the reuse.

Acceptance criteria

• On set or reset, the password is checked against a list of breached password hashes we download and keep locally. Nothing about the password leaves our servers.
• Refused with: "This password has appeared in a data breach elsewhere. Choose another."
• Existing passwords aren't checked (we don't have them).