2.1.7 small fix

[jmanico]

SP800-63 says 50,000-150,000 common passwords, not 50,000-100,000 common passwords

[jmanico]

We should also split 2.1.7 into two requirements, one for common passwords and another for credential stuffing defense

[elarlang]

Just for mapping:

• spliting 2.1.7 is proposed in Discussion: rules for password format and content #683 (Recommendation 3)
• spliting 2.1.7 is proposed in [For Improvement] Removal of checking of passwords during login against a set of breached passwords for 2.1.7 #841 (comment), [For Improvement] Removal of checking of passwords during login against a set of breached passwords for 2.1.7 #841 (comment)

[elarlang]

in #841 / 10b865f changed to:

Verify that passwords submitted during account registration or password change are checked against an available set of, at least, the top 3000 passwords.