Add a common password blacklist

Summary:
Fixes T4143. This mitigates the "use a botnet to slowly try to login to every user account using the passwords '1234', 'password', 'asdfasdf', ..." attack, like the one that hit GitHub.

(I also donated some money to Openwall as a thanks for compiling this wordlist.)

Test Plan:
  - Tried to register with a weak password; registered with a strong password.
  - Tried to set VCS password to a weak password; set VCS password to a strong password.
  - Tried to change password to a weak password; changed password to a strong password.

Reviewers: btrahan

Reviewed By: btrahan

CC: aran, chad

Maniphest Tasks: T4143

Differential Revision: https://secure.phabricator.com/D8048

src/applications/auth/controller/PhabricatorAuthRegisterController.php

@@ -182,6 +182,14 @@ final class PhabricatorAuthRegisterController
           $errors[] = pht(
             'Password is too short (must be at least %d characters long).',
             $min_len);
+        } else if (
+          PhabricatorCommonPasswords::isCommonPassword($value_password)) {
+
+          $e_password = pht('Very Weak');
+          $errors[] = pht(
+            'Password is pathologically weak. This password is one of the '.
+            'most common passwords in use, and is extremely easy for '.
+            'attackers to guess. You must choose a stronger password.');
         } else {
           $e_password = null;
         }