Add breached password references to section 2.1

[jmanico]

Resources to consider:

https://github.com/danielmiessler/SecLists/tree/master/Passwords

https://www.ncsc.gov.uk/blog-post/passwords-passwords-everywhere#:~:text=PwnedPasswordsTop100k.txt

cc: @cmlh

[tghosth]

@jmanico the current requirement says (emphasis mine):

2.1.14 Verify that passwords submitted during account registration or password changes are checked against a set of breached username/password pairs. (C6)

The links above only include passwords and not usernames so I am not sure they are useful for this control. Or did we mean to use this in reference to the following requirement:

2.1.7 [MODIFIED, SPLIT TO 2.1.14] Verify that passwords submitted during account registration or password change are checked against an available set of, at least, the top 3000 passwords.

[jmanico]

I am happy to move this to just "breached passwords" only.

[tghosth]

@jmanico opened PR #1234