Issue #3277003 by mcdruid, catch, poker10, smustgrave, BramDriesen, guedressel, DamienMcKenna, xjm, Heine, greggles, fjgarlin, pwolanin, moshe weitzman: Harden user_pass_rehash() against attack