Username character blacklist can now be altered via plugin hook

Also removes hyphen from the blacklist making it a valid character by default.

Fixes #6189
Describe available inputs and expected output.