(WIP) Adds rule that password not appear in a blacklist

Feedback welcomed. E.g. the JS version should not block the password, right? I added a few comments to help IDE comprehension. I know this needs tests.