Check user passwords against HIBP on login

[colby-swandale]

What's this about?

This PR implements password breach checking against the https://haveibeenpwned.com (HIBP) database during user login. When a user attempts to sign in with a password that appears in known data breaches, the system will prompt the user to change their password.

When users have MFA enabled, they are allowed to complete login but are then redirected to reset their password. If the user does not have MFA enabled, they will be asked to complete an out-of-band password reset via the standard rubygems.org password reset email.

Why this matters

Credential stuffing attacks are one of the most common vectors for account compromise. Users frequently reuse passwords across services, so when credentials leak from one site, attackers try them everywhere. This feature proactively protects RubyGems.org users and the Ruby ecosystem from compromised credentials being used to access accounts.

Screenshots

Users With MFA after login

TODO

Users Without MFA after login

[codecov]

Codecov Report

❌ Patch coverage is 88.57143% with 8 lines in your changes missing coverage. Please review.
✅ Project coverage is 97.17%. Comparing base (9dd7241) to head (99bff3c).

Files with missing lines	Patch %	Lines
...vents/user_event/password/compromised_component.rb	0.00%	7 Missing ⚠️
lib/password_breach_checker.rb	90.00%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #6119      +/-   ##
==========================================
- Coverage   97.24%   97.17%   -0.07%     
==========================================
  Files         476      479       +3     
  Lines        9785     9854      +69     
==========================================
+ Hits         9515     9576      +61     
- Misses        270      278       +8     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.