Warn users when they use/save a vulnerable password

[fmarier]

We could make use of the HIBP Pwned Passwords API to warn users when they enter a vulnerable password in a password field or when they save one in the password manager.

1Password includes this functionality as part of their "Watchtower":

A vulnerable password is one that is present in the data dumps from one of the password leaks tracked by Have I Been Pwned.

This does not require a back-end service as long as we're comfortable with the k-anonymity guarantees of the public API.

[BrendanEich]

I like this idea. Even better if we can assist users in changing to better passwords, although that sounds complicated.

[fmarier]

Closing in favor of #12001.