Use bcrypt's public cost attr instead of internal constant

This is a follow-up to https://github.com/rails/rails/pull/12326, with a test case to show that this is actually a bug.

This _does not_ add an option to Rails, like https://github.com/rails/rails/pull/285 did. This is merely using the new public API of bcrypt-ruby introduced in version 3.1.0 -- [cost should be accessed externally by the `BCrypt::Engine.cost` attribute](https://github.com/codahale/bcrypt-ruby#cost-factors).  It continues to default to the old `DEFAULT_COST` constant internally, but can additionally be set externally if desired.

As it stands now, if a user uses the provided and recommented `cost` accessor from bcrypt-ruby, Rails will ignore it and set it _back_ to `DEFAULT_COST` [here](https://github.com/tjschuck/rails/blob/dd13722c264a84e81ce15a6ec168c84d4db460ca/activemodel/lib/active_model/secure_password.rb#L106).

The new test clarifies this error, and fails without the provided change.

/cc @jeremy