Fix #87: security helper converted into component and improved

Fix #87: security helper improvement

Migrated from #4052
@ircmaxell 

Our purpose here is to slow down dictionary attacks on passwords so I'm not sure HKDF is suited. It says in Section 4:

>   On the other hand, it is anticipated that some applications will not
   be able to use HKDF "as-is" due to specific operational requirements,
   or will be able to use it but without the full benefits of the
   scheme.  One significant example is the derivation of cryptographic
   keys from a source of low entropy, such as a user's password.  The
   extract step in HKDF can concentrate existing entropy but cannot
   amplify entropy.  In the case of password-based KDFs, a main goal is
   to slow down dictionary attacks using two ingredients: a salt value,
   and the intentional slowing of the key derivation computation.  HKDF
   naturally accommodates the use of salt; however, a slowing down
   mechanism is not part of this specification.  Applications interested
   in a password-based KDF should consider whether, for example, [PKCS5]
   meets their needs better than HKDF.

[PKCS5] is [PBKDF2](https://tools.ietf.org/html/rfc2898#section-5.2) and the problem we're facing is what to do in PHP 5.4 when PHP's `hash_pbkdf2()` buit-in is not available. My understanding was that the iterated HMAC we use here is a PHP implementation of PBKDF2.