Stop people using very common passwords

If a user chooses a very common password then an attacker could guess it
in relatively few attempts, circumventing the lockout.

CESG recommend blacklisting the most common passwords:

> …enforcing the requirement for complex character sets in passwords is
> not recommended. Instead, concentrate efforts on technical controls,
> especially:
>
> - defending against automated guessing attacks by either using account
>   lockout, throttling, or protective monitoring
> - blacklisting the most common password choices

How I made this list:

- went to the OWASP repository of security lists:
  https://github.com/danielmiessler/SecLists

- downloaded `10k_most_common.txt`, `twitter-banned.txt` and
  `500-worst-passwords.txt`

- filtered out any under 8 characters:
  ```
  sed -r '/^.{,7}$/d' passwords-twitter.txt > passwords-combined.txt
  sed -r '/^.{,7}$/d' passwords-500.txt >> passwords-combined.txt
  sed -r '/^.{,7}$/d' passwords.txt >> passwords-combined.txt
  ```

- filtered out any duplicates:
  ```
  cat passwords-combined.txt | awk '!x[$0]++' > passwords-combined-deduped.txt
  ```

tests/app/main/test_validators.py

@@ -5,13 +5,16 @@ from wtforms import ValidationError
 from unittest.mock import Mock
 
 
-def test_should_raise_validation_error_for_password(app_, mock_get_user_by_email):
+@pytest.mark.parametrize('password', [
+    '11111111', 'kittykat', 'evangeli'
+])
+def test_should_raise_validation_error_for_password(app_, mock_get_user_by_email, password):
     with app_.test_request_context():
         form = RegisterUserForm()
         form.name.data = 'test'
         form.email_address.data = 'teset@example.gov.uk'
         form.mobile_number.data = '441231231231'
-        form.password.data = 'password1234'
+        form.password.data = password
 
         form.validate()
         assert 'That password is blacklisted, too common' in form.errors['password']
@@ -30,7 +33,7 @@ def test_valid_email_in_valid_domains(app_):
             name="test",
             email_address="test@my.gov.uk",
             mobile_number='4407888999111',
-            password='1234567890')
+            password='an uncommon password')
         form.validate()
         assert form.errors == {}