[8.x] Add default timeout to NotPwnedVerifier

[pgrenaud]

The NotPwnedVerifier makes HTTP request to verify that the given password has not been compromised in public breaches using the Have I Been Pwned public API. Any HTTP request made to an external service can hang for a long time if this service is under heavy load and not responding in a prompt manner. The HTTP request is made using Guzzle, which default to wait indefinitely.

This PR defines a default timeout value of 15 seconds to be use by the NotPwnedVerifier when making HTTP request to the API. The value of 15 seconds is a value that we use in production for some API. We could argue that this value could be higher or lower, and I would happily change it. But I do think that it is important that some timeout value be configured to prevent the request made by the end user from hanging for a long time or reaching PHP's max_execution_time of 30 seconds.

I would like to expose this value to the configuration (it is already configurable by the service provider), but I'm not sure in which configuration file it should be.

Also, I would have like to add a unit test to simulate this exact scenario, but unfortunately, since the request never reaches CURL in the testing environment, the timeout value has no effect.

[pgrenaud]

@GrahamCampbell Sorry about that! I've made the requested fixes.

[foremtehan]

I think 3 or 5 seconds is appropriate amount of time to wait