FFI: Add zxcvbn dependency for password strength evaluation

[mredig]

Adds PasswordStrengthEstimator to the FFI layer, backed by the zxcvbn crate. The estimator accepts caller-configured PasswordStrengthThresholds so clients can tune ranking boundaries to reflect current hardware attack rates rather than zxcvbn's decade-old defaults. Two built-in threshold sets are provided: one matching zxcvbn's original boundaries, and one tuned for modern hardware (based on hive systems latest/2025 password ranking chart).

Notes:

• The threshold-to-ranking logic lives in the FFI layer rather than a core crate — it was explicitly requested to add this dependency to the ffi layer, but I believe that was also with the assumption that it'd just be plainly forwarding the public interface of the upstream. This is acknowledged as a deviation from convention per feat: expose m.fully_read event ID on RoomInfo #6569. Happy to move it if preferred.

• zxcvbn is pinned to a specific git commit rather than a released version. The latest release (3.1.1) has a bug where guesses_log10 incorrectly caps at log10(u64::MAX) despite the field being documented as tracking the unsaturated value. This is fixed in master (4e8e784) but not yet released.

• The Rust crate's output also diverges from the original JS zxcvbn in some cases — it tends to score more harshly, which is conservative and acceptable, but worth noting.

• It appears that deny.toml needs an update with the zxcvbn dependency, but I'm not sure if that's my place or something you want to do. I'm happy either way.

• I've documented the public API changes in the appropriate changelog files (see Writing changelog entries).

• This PR was made with the help of AI.

Signed-off-by: Michael Redig juniper.fife_0b@icloud.com

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 89.95%. Comparing base (805f981) to head (12a742e).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #6708      +/-   ##
==========================================
+ Coverage   89.94%   89.95%   +0.01%     
==========================================
  Files         397      397              
  Lines      110751   110751              
  Branches   110751   110751              
==========================================
+ Hits        99611    99628      +17     
+ Misses       7367     7350      -17     
  Partials     3773     3773              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

[codspeed-hq]

Merging this PR will not alter performance

✅ 50 untouched benchmarks

---

_{Comparing mredig:mredig/pw-strength-dependency (12a742e) with main (805f981)}

[andybalaam]

Removed myself from review since this is in draft.

Is this something that you have been speaking to someone on the team about? If so, it's probably worth binging them here when you're ready.

[manuroe]

@stefanceriu is plenty aware of this addition as he asked for it. I added him as a reviewer to avoid confusion.

[stefanceriu]

Right, sorry about that Andy, should've said something. EX platform folks suggested this approach and I also raised it with the larger Rust team, nobody saw any problems with it.