make password policy configurable in admins settings #8591
Description
This would be a follow up to #8585
Basically, make it so the 3 hardcoded constants in src/packages/util/auth.ts are defaults, which can be overwritten via admin settings. Then any site can define their own password policy, and we can also adjust ours if needed.
I don't view this change as completely easy/trivial, since admin settings are in thew database and async, whereas those constants are in our code and sync, so much easier to access from anywhere else in our code. That's one reason I didn't suggest this for the PR.