The following error cases are reported to the client directly or indirectly, in a way that lets an attacker guess whether a user exists or not, or whether they have a password at all, etc:

• the user does not exist
• there was an error retrieving the password
• the password is empty (password auth cannot continue)
• the password is expired
• the password check has failed

All these cases must be replaced by a single error sent to the client "password auth has failed" - all these situations should be indistinguishable from each other from an attacker's perspective. (However, they must still be distinguished in the authentication logs.)

cc @aaron-crl

Jira issue: CRDB-4397