Unicode normalize passwords

[NotAFile]

(as discussed in #synapse-dev)

The code currently does no normalization of any kind on the password before hashing. This is problematic™ because with Unicode, multiple representations can exist for a single character. This would mean that depending on how exactly the users system does text entry, the same password entered on a different system, or version of that system, might have a different hash.

The solution to this is normalization. Apparently, according to other people, NFKD or NFKC is what you want here.

Problems:

• Unless something like versioning or fallback is done, normalization will break many peoples password

Advantages:

• If normalization is done, peoples passwords won't break the next time someone decides to change their Unicode input code a bit.

[hawkowl]

We now normalise with NFKC. We don't do any versioning or fallback, assuming mostly that people's passwords were inconsistently broken before, and now they're at least broken consistently.