Update password length validation to 72 characters max

BCrypt has a limit of 72 characters for the password. Anything beyond 72 characters is truncated:

```ruby
require 'bcrypt'
password = 'a' * 72 
digest = BCrypt::Password.create(password) 
digest == password # => true
digest == password + 'foobar' # => true
digest == 'a' * 128 # => true
```

This commit updates the validation to limit passwords to less than 72 characters, keeping within the limitation.

For similar discussion, please see rails/rails#14591 and rails/rails#15708 where `has_secure_password`'s validations were updated for this same reason.

I should note that I didn't make the change in [`lib/devise.rb`](https://github.com/plataformatec/devise/blob/e54326c19c68f10df2548fcaaab411e93178b279/lib/devise.rb#L126-L128), as I thought that would introduce a backwards-incompatible change.