Fix #87: security helper converted into component and improved

Fix #87: security helper improvement

Migrated from #4052
@klimov-paul This advice from ircmaxell is good. I have satisfied myself that automatic fallback to a PHP implementation of PBKDF2 is fast enough and OK. So we can remove the 'pbkdf2/hmac' configuration option. (Sorry to have caused work by flip-flopping.)

But PBKDF2 is not needed when the user-supplied key is not a password but is a proper encryption key. In this case HKDF is sufficient and much faster.