Hash password reset keys in the database.

All existing, unused password reset keys are now considered "expired" and the user will be told they should try again.

Introduces a password_reset_key_expired filter to allow plugins to introduce a grace period.

fixes #24783.


git-svn-id: https://develop.svn.wordpress.org/trunk@25696 602fd350-edb4-49c9-b593-d223f7449a82