XWIKI-5261 : Password hashes dumpable.

This little fix salt every password. To make sure there is no backward compatibility issue, I treat former unsalted password the same way as before. But when a user changes his password, or when a new user is created, the passwords thus created are automatically salted with a random salt stored in the password.
If we want double salting (or encrypting hashes), it should be easy to add it.
In addition, I hide the password field from the $doc.getValue() method. To be consistent, I did it exactly the same way it is already done in the getValue() method in com.xpn.xwiki.api.Propety.java.  
Actually there is no positive guarantee that this constructor will *ever* complete. If you have access to the CM from here, you can get a pre-configured SecureRandom instance which makes it @dgervalle 's problem to make sure it's seeded. Anyway this function looks like a 19 line version of `org.apache.commons.lang.RandomStringUtils.randomAlphanumeric(12)`