Added Security::generateRandomHexKey(), used it for various tokens and default key generation

Fixes #4114.

Needs review.
Should point out the chars may not be ASCII and refer to `generateRandomKey()`.