Prevent users from including their username in their password
I found that the Password Policy module actually does have an option to prevent the user from including their username in their password. The broader issue about how to restrict arbitrary strings from a user's password still stands though.