Username character blacklist can now be altered via plugin hook

Also removes hyphen from the blacklist making it a valid character by default.

Fixes #6189

TODOs:
 - [ ] Flesh out rst docs
Clearer: "Filters the string of blacklisted characters used to...".