Enforce minimum length/complexity for recovery keys

[gibmat]

At the moment IncusOS will happy set a recovery key that is weak. We should add configuration options (with decent defaults) to allow the user to enforce length or complexity requirements.

[stgraber]

Marking as Maybe given that both the recovery keys and the complexity configuration would be in the same API/config endpoint, so not too sure what the value of that would be :)

Now if we want to have hardcoded minimum requirements, that I think would make sense and would take care of this issue.

[gibmat]

I'm not thinking of defending against a malicious actor, since if they can access that endpoint it's game over already, but rather setting some good guardrails out of the box. It might also be useful for something like Operations Center enforcing a recovery key policy for all its managed servers.