Set a minimum level of entropy for passwords

We currently do not enforce anything about password entropy, or randomness.

This is a concern; people can use weak passwords, and re-use passwords across different services.

This change means that passwords must meet a (currently fairly low) entropy threshold. Arguably the required degree of randomness should be higher.

This does not affect existing passwords and will only come into force when a user has to change their password.