Update password length validation to 72 characters max

[lleger]

BCrypt has a limit of 72 characters for the password. Anything beyond 72 characters is truncated:

require 'bcrypt'
password = 'a' * 72 
digest = BCrypt::Password.create(password) 
digest == password # => true
digest == password + 'foobar' # => true
digest == 'a' * 128 # => true

This commit updates the validation to limit passwords to less than 72 characters, keeping within the limitation.

For similar discussion, please see rails/rails#14591 and rails/rails#15708 where has_secure_password's validations were updated for this same reason.

I should note that I didn't make the change in lib/devise.rb, as I thought that would introduce a backwards-incompatible change.

[josevalim]

❤️ 💚 💙 💛 💜

[lleger]

👍 💯

[rubyrider]

(y)

[tmilewski]

🔒 👍

[dcsim]

💘 🔑 💘