Create a separate Work Challenge check

This allows us to tell lock checks from FBE checks separately,
and will be useful when dealing with password unification.

Change-Id: Ifbea425f749fee4d6d51faddd8b64bf717a1a5f8