feature(users): Username character blacklist can now be altered via plugin hook

Also removes hyphen from the blacklist making it a valid character by default.

Fixes #6189