Check user passwords against HIBP on login

[colby-swandale]

What's this about?

This PR implements password breach checking against the https://haveibeenpwned.com (HIBP) database during user login. When a user attempts to sign in with a password that appears in known data breaches, the system will prompt the user to change their password.

When users have MFA enabled, they are allowed to complete login but are then redirected to reset their password. If the user does not have MFA enabled, they will be asked to complete an out-of-band password reset via the standard rubygems.org password reset email.

Why this matters

Credential stuffing attacks are one of the most common vectors for account compromise. Users frequently reuse passwords across services, so when credentials leak from one site, attackers try them everywhere. This feature proactively protects RubyGems.org users and the Ruby ecosystem from compromised credentials being used to access accounts.

Screenshots

Users With MFA after login

TODO

Users Without MFA after login

[codecov]

Codecov Report

❌ Patch coverage is 26.19048% with 62 lines in your changes missing coverage. Please review.
✅ Project coverage is 38.56%. Comparing base (169da15) to head (4b20855).

Files with missing lines	Patch %	Lines
app/controllers/sessions_controller.rb	22.72%	17 Missing ⚠️
app/helpers/users_helper.rb	20.00%	12 Missing ⚠️
...pp/controllers/compromised_passwords_controller.rb	46.15%	7 Missing ⚠️
app/controllers/passwords_controller.rb	0.00%	7 Missing ⚠️
...vents/user_event/password/compromised_component.rb	0.00%	7 Missing ⚠️
lib/password_breach_checker.rb	40.00%	6 Missing ⚠️
app/mailers/password_mailer.rb	20.00%	4 Missing ⚠️
app/controllers/concerns/require_mfa.rb	0.00%	1 Missing ⚠️
app/controllers/email_confirmations_controller.rb	0.00%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #6119      +/-   ##
==========================================
- Coverage   38.65%   38.56%   -0.09%     
==========================================
  Files         487      490       +3     
  Lines       10718    10799      +81     
==========================================
+ Hits         4143     4165      +22     
- Misses       6575     6634      +59     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.