Fix #87: security helper converted into component and improved

Fix #87: security helper improvement

Migrated from #4052
1. Anthony is right (except we shouldn't be using openssl's RNG either).

2. An insecure fallback is a security hole whether it is a fallback or not.

3. Yii 2.0 is still beta. Backward compatibility with 1.1 is not a requirement at all. BC with earlier 2.0 versions it is not as important as fixing security.

People without mcrypt need to get it if they are to use crypto. We should push them. And we will never have a better opportunity than we have now.