index: use pbkdf2-compat instead of cryptojs

As simple as it sounds, uses `pbkdf2` directly.

On the plus side, the tests now only take `<1` second and we just removed a huge dependency.
On the down side, we'll have to wait for https://github.com/dominictarr/sha.js/pull/8 to be merged and then consequently pushed upstream to `crypto-browserify` before this can be used in the browser.