NEW: entropy() for calculating password strength (NIST 800-63)