Elasticsearch: Allow enforcing minimum password strength

[elasticmachine]

Original comment by @loekvangool:

We should allow administrators to add more requirements to passwords. We now (5.0.0) enforce a minimum length of 6 (at least in UI), but many enterprises require more.

Taking inspiration from Wikipedia, we could support:

1. the use of both upper-case and lower-case letters (case sensitivity)
2. inclusion of one or more numerical digits
3. inclusion of special characters, such as @, #, $
4. prohibition of words found in a password blacklist
5. prohibition of words found in the user's personal information
6. prohibition of use of company name or an abbreviation
7. prohibition of passwords that match the format of calendar dates, license plate numbers, telephone numbers, or other common numbers

I'm proposing that out of these we at least add support for 1, 2, 3. Bonus kudos if we support LINK REDACTED, which basically means: if the password reaches a minimum length of, say, 20, drop the other rules.

[synapticiel]

1. Force user to change password after first login

[mmmichal]

is there any due date for this?