review password policy

[davepacheco]

We should decide if we want the public API to enforce any particular policy regarding password security (e.g., minimum length, characters used, etc.). I have no particular opinion on this but it seems like something we should decide explicitly before MVP.

References:

omicron/nexus/types/src/external_api/params.rs

Lines 223 to 225 in 9d1bd55

	// TODO-security If we want to apply password policy rules, this seems
	// like the place. We presumably want to also document them in the
	// OpenAPI schema below.

omicron/nexus/types/src/external_api/params.rs

Lines 252 to 253 in 9d1bd55

	// TODO-doc If we apply password strength rules, they should
	// presumably be documented here.