WIP for #4665 (improved password hashing)

This creates a new users_entity column and populates it whenever the password is available. Also deprecates setting salt/password attributes in favor of a setPassword() method that makes sure everything is done.

The hope is to get this in 1.10. If full migration must wait, we'll still be storing new hashes so fewer users will need to password reset if the site owner decides to erase all the old hashes.

Thoughts on this direction/idea?
`@access private`?