Hard-checks password length according to configured rule (default: at least 8 characters). Closes #22351