Password rules language doesn’t allow us to express requirement that password not contain the same character twice

Spotted at https://www.netteller.com/login2008/Authentication/Views/Login.aspx (to get to the same page, go to https://www.sagaftrafcu.org/, click "Login", enter any username, click "Forgot Password" on the subsequent page).


Note the requirement:

```
Cannot repeat the same character more than twice (e.g. “ACTORAFTR” or “SAG111”)
```

The password rules language provides no way to express this requirement. We can currently place a restriction on the max number of _consecutive_ characters (via the `max-consecutive` keyword), but not the max number of the same character overall.