Add support for the remote query API. This obviates the need to download
the > 10 GB pawned password hash list, which requires nearly 20 GB after
decompression.

The API does not transfer the queried password or its full SHA1 hash to
the server, but only the first 5 characters of the hash. This allows to
retrieve the full password hashes that match that prefix (typically in the
order of 500) and then to check whether the password to test matches any
of the hashes returned.

Approved by: antoine (implicit)