XWIKI-5261 : Password hashes dumpable.

This little fix salt every password. To make sure there is no backward compatibility issue, I treat former unsalted password the same way as before. But when a user changes his password, or when a new user is created, the passwords thus created are automatically salted with a random salt stored in the password.
If we want double salting (or encrypting hashes), it should be easy to add it.
In addition, I hide the password field from the $doc.getValue() method. To be consistent, I did it exactly the same way it is already done in the getValue() method in com.xpn.xwiki.api.Propety.java.  
@sdumitriu @cjdelisle Not sure about the `SecureRandom`.

@cjdelisle Can you give more details on what what you meant by getting a pre-configured SecureRandom instance with the ComponentManager? Do we have that available? Not sure what component/module you are referring to.

This seems more appropriate for the `randomSalt` method:
`
org.apache.commons.lang3.RandomStringUtils.random(int count, int start, int end, final boolean letters, final boolean numbers, final char[] chars, final Random random)
`
I wonder if there is any practical reason for which to limit the characters of the salt to 0-9a-f (hex). The only thing I can think of is that the stored password will look nicer (consistent in terms of characters with the hash-string generated by the hash algorithm).