Fix potential bugs in password_hash(), CI_Encryption

strlen(), substr() are not byte-safe when mbstring.func_overload is enabled