security(passwords): switches password hashing to password_hash()

This gradually migrates users to modern hashes as they log in; deprecates
setting the salt/password attributes in favor of a new setPassword() method
(setting salt/password continues to work but will revert the user to the
legacy MD5 hashing); and moves core password functionality to a
PasswordService object.

Fixes #4665
Merge pull request #7594 from mrclay/4665_110

security(passwords): switches password hashing to password_hash()
perf(annotations): increased performance of egef_annotations

The default behaviour of elgg_get_entities_from_annotations was
different from all other elgg_get_entities_from* functions.
This also caused a performance issue on large databases

Fixes #6638
Merge pull request #7600 from mrclay/jeabakker-elgg-get-entities-from-annotations

perf(annotations): increased performance of egef_annotations