Configurable password policy

[michaelbromley]

Is your feature request related to a problem? Please describe.
When using native auth, there is no server-side check on the password. So extremely weak passwords like "1" would be accepted when registering a customer account. While the storefront application can enforce some stronger policy, we should also be able to enforce it at the server level too.

Describe the solution you'd like
A new config option:

authOptions: {
  passwordPolicy: (password: string) => boolean | string;
}

This allows a custom function to be defined which can enforce min length and any other character-related requirements desired. Returning true allows the registration to proceed. Returning false or a string will prevent the operation and return an ErrorResult with any message returned by the function (or a generic one).