Added Security::generateRandomHexKey(), used it for various tokens and default key generation

Fixes #4114.

Needs review.
Well, the caller requests for 32 chars while the method returns 64. That's not expected.
For non-even length parameter, I think it's fine we do some postprocessing. For example, if length is 11, we generate a string with 12 chars and take the first 11. This should be clearly warned in the method comment, though.