Use bcrypt's public cost attr, not internal constant

Backport to 4-0-stable, requested by @jeremy on https://github.com/rails/rails/pull/12339