[SR] Check "Reject weak passwords" option by default on new installs

[jenlampton]

We've gotten several reports on hunter.dev about backdrop allowing weak passwords by default. I agree that it would be better to check this box by default, for new installs. For those who prefer to allow weak passwords on local sites for development, they will still have the option to disable it.

I propose we introduce this change as a security hardening.

Related:

• [SR][UX] Password strength: provide suggestions to make it stronger #5220
• [SR][UX] Provide more guidance on password strength required #5095
• [SR] Enforce basic password constraints: no username, no email #4265

[klonos]

This makes sense (so long as we make this the default for new installations and don't change existing sites).

[yorkshire-pudding]

Makes sense to me