Constraints showing when they shouldn't

I see that the constraint for special_count is shown even when disabled (0 or nothing set for special_count value).

Just looking at password_policy_password_element_alter().

Calls the messages:

  foreach ($policies as $policy) {
    $items = array_merge($items, $policy->messages());
  }

Which blindly check the defaults against what is saved.

Issue is that if they changed the default value, this constraint is considered active. Like just one char in this string was enough.

`~!@#$%^&*()_+=-|}{"?:><,./;'\[]

Clearly something like PasswordPolicyItem::isActive() should be used here, but no idea of the internals. This one is inactive if either special_count or special_count_chars are empty, so PasswordPolicyItem::isActive() is a bit simplistic.