* allow a specific set of credentials
* reject a certain type of credentials
* deny password that can be easily cracked
* enforce use of an expiration date with a minimum of day for a password
* define a password reuse policy
* define the number of authentication failure allowed before a user is banned
* define a delay on authentication failures
* force users to change their password after first login
* throw a warning N days before when the password user is about to expire

- Allow no password policy checks at all for changes done by a superuser
enabling new GUC `credcheck.superuser_nocheck`.
- Add feature "Disallow password change" to disallow users to change
their password. This behavior is enabled by enabling new GUC
`credcheck.disallow_password_change`. It returns the following message
when a user tries to change its password:
`ERROR:  you are not allowed to change your password.`
- Fix `credcheck.password_valid_until` when CREATE/ALTER ROLE is called from a plpgsql block.
- Fix password_valid_until / password_valid_max behavior.