#8279 Additional login security checks
Using previous login details from [#8278], if someone logs in from a new location and has a potentially compromised password (per the HIBP check), it could be good to block the login and force a password reset via email. If 2FA is successful though, probably let that through. Make optional, configurable, and customizable with auth providers.
Branch db/8279