allow web admins to notify authier users that their password was leaked

[capaj]

We should have an api to allow any web domain owner to notify users their account password got leaked.
This will be on 2 levels of granularity:

1. per single username when they had a leak in logs for example
2. for all usernames on domain/subdomain (for example when whole DB is compromised like here https://forum.opensubtitles.org/viewtopic.php?f=1&t=17685&p=46818#p46818

web admins would only get access to this when they prove they own a domain with a custom TXT record.

When reported, we would mark the password as leaked in the UI and we would link user to a change password page(this would be entered by website admin when reporting the leak)