Added Security::generateRandomHexKey(), used it for various tokens and default key generation

Fixes #4114.

Needs review.
As I've noted before we can use `$key = substr(strtr(base64_encode($binary), '+/=', '_-.'), 0, 22);` and it will generate less characters from the same string.