feat: support unknown credentials leaks

[joaomagfreitas]

we are lacking leaks of databases which credentials are already hashed. originally we want to keep plain text credentials to promote the "what's my leaked password" feature, but we are missing critical leaks if we only include plain text ones.

also, we need to investigate legality of allowing credential request!