Deny access to blocked users

ExternalAuth::login() should probably deny access to blocked users. Or at least, provide documentation that it doesn't and that every provider which doesn't piggyback on the login form, should do this by themselves.

This restriction is currently implemented in UserLoginForm::validateName().

This issue for now is just a note for the future / to make explicit that the module doesn't do this; I'm not going to implement it myself at the moment because I've implemented it in my own provider... and I'm going to see where 🐛 Prevent registration with duplicate email Closed: won't fix ends up (which is also discussing additional validation).