WIP for #4665 (improved password hashing)

This creates a new users_entity column and populates it whenever the password is available. Also deprecates setting salt/password attributes in favor of a setPassword() method that makes sure everything is done.

The hope is to get this in 1.10. If full migration must wait, we'll still be storing new hashes so fewer users will need to password reset if the site owner decides to erase all the old hashes.

Thoughts on this direction/idea?
I thought we had abandoned updating this because it doesn't handle the branches model well. Or was it auto-updated by a script or something?