feat: add levenshtein distance check for password validation

[zepatrik]

Related issue

closes #184

Proposed changes

Checklist

• I have read the contributing guidelines
• I have read the security policy
• I confirm that this pull request does not address a security vulnerability. If this pull request addresses a security
  vulnerability, I confirm that I got green light (please contact security@ory.sh) from the maintainers to push the changes.
• I have added tests that prove my fix is effective or that my feature works
• I have added necessary documentation within the code base (if appropriate)
• I have documented my changes in the developer guide (if appropriate)

Further comments

[aeneasr]

Can we make this configurable in the config file, and also document this in ? :)

[aeneasr]

https://www.ory.sh/docs/kratos/self-service/strategies/username-email-password#security-and-defenses

[k415hu]

I think, this thing has been implemented. Right?

func (s *DefaultPasswordValidator) Validate(ctx context.Context, identifier, password string) error { passwordPolicyConfig := s.reg.Config(ctx).PasswordPolicyConfig() if len(password) < int(passwordPolicyConfig.MinPasswordLength) {

[zepatrik]

You mean the configuration? Does not look like the values come from the config rn:

kratos/selfservice/strategy/password/validator.go

Line 155 in 10778fd

if dist < s.minIdentifierPasswordDist || lcs > s.maxIdentifierPasswordSubstrThreshold {