Allow (enforce?) changing ssh user password from defaults

Split out from #3481.

In a similar vein to #1822, the current approach is needlessly poor security practice, even if it's not important for most users right now.

Start by reading #3481 and #1822, which this issue references; no file, test, or entry point is named. First resolve whether users should be allowed or forced to change the default SSH password, then define completion around the chosen security behavior and its validation.

Written by the indexing model from the issue text.