Implement pluggable password policies

Adding password policy checks is currently pretty hard to do (see #2971 (closed), #2652 (closed)). It involves:

• Writing a plugin to implement the behavior
  • by definition
• Adding manager options
  • no way around this for now
• Adding translation labels
  • no way around this for now
• Adding frontend code to portal.coffee/portal.js
  • should not be needed
• Adding a bunch of template variables to Display.pm + some plugins (PasswordReset.pm)
  • should not be needed
• Modifying existing templates
  • maybe not needed?

This is much too complex, in the sense that it involves too many different components. We need to make it simpler (less components involved) by providing hooks or portal methods that let plugins easily inject JS code, HTML template, etc into pages. The new Captcha system (#2692 (closed)) could be taken as inspiration