Use PBKDF2 for user password hashing (2)

This pull request is a squashed version of tkmorris's work in #169 as well as a substantial review and refactoring commit hopefully resolving the remaining issues to get this merged. As this patchset changes highly critical authentication as well as database code please review and test carefully.

At this point I only did very rudimentary testing. Namely database creation, update from last version, PBKDF2 benchmark and iteration updates (with SuperUser only and no other users). I also verified that what ends up in the database matches the PBKDF2 hash returned by hashlib in python. This patch will require testing with actual real-life databases.
I am fine with this being a qFatal as long as it's not something that can be triggered by a potential attacker. (That is., qFatal should only be triggered if we've made a programmer error.)

That seems to be the case according to https://www.openssl.org/docs/crypto/PKCS5_PBKDF2_HMAC.html

The source also seems to agree, I think. (There are a lot of failure cases for HMAC_CTX_copy and the like, but I think those fall under the above criteria...)