Support "Check existing user passwords for compromise regularly" Mandated by MSVP "2.4 Password policy"

[cmlh]

"2.4 Password policy" of MVSP mandates Check existing user passwords for compromise regularly

V2 Authentication Requirement 2.1.7 states:
Verify that passwords submitted during account registration, login,
and password change are checked against a set of breached
passwords either locally (such as the top 1,000 or 10,000 most
common passwords which match the system's password policy) or
using an external API. If using an API a zero knowledge proof or
other mechanism should be used to ensure that the plain text
password is not sent or used in verifying the breach status of the
password. If the password is breached, the application must
require the user to set a new non-breached password. (C6)

Should we include this as a new Requirement in the next release of ASVS?

The parent of this issue is #1151.

FYI @jmanico

[elarlang]

Discussion on the topic is carried out in #841