Hash web panel passwords with Argon2id

[refringe]

• Add IPasswordHasher and Argon2id implementation
• Hash passwords on create/update instead of storing plaintext
• Passwords are no longer trimmed
• Verify logins against stored hashes
• Rehash credentials when cost parameters change
• Migrate existing plaintext credentials to hashes on startup
• Seed config default user with a hashed password
• Verify failed logins against a dummy hash to keep timing constant
• Stop exposing/editing stored passwords in the credentials UI panel
• Adds some tests for the hasher

[ArchangelWTF]

Have some concerns about the current package used, would love to ideally just implement ourselves since it doesn't seem too bad

[refringe]

I chose Scott's package because it uses libsodium, which uses the official C implementation compiled directly from the original Argon2 authors.

If you'd rather the pure sharp implementation I can take a look later this afternoon.

I'm good either way. They're both tested implementations.

[ArchangelWTF]

Oh I got no problems with using libsodium, the only issue I have with pulling in Scott's package is that it's only about ~100ish lines that we could just write ourselves and save the trouble of potentially having a package go unmaintained.