[Improve] Replace SHA-256 password storage with PBKDF2

[wolfboys]

What changed

• Replace new password storage from salted SHA-256 to PBKDF2-HMAC-SHA256.
• Use 600,000 PBKDF2 iterations, 16-byte random salt, and a self-describing password hash format.
• Keep legacy SHA-256 verification only for successful-login migration.
• Rehash legacy or lower-work-factor password hashes after successful authentication.
• Update user create/update/reset flows to store PBKDF2 hashes.
• Expand t_user.password from varchar(64) to varchar(255) for PBKDF2 hash strings.
• Update seed user password hashes.
• Remove ShaHashUtils and keep legacy SHA-256 compatibility inside PasswordHashUtils.

Why

The previous password storage used fast SHA-256 hashing, which is not appropriate for password storage and is vulnerable to offline brute-force attacks if the password
database is leaked.

PBKDF2-HMAC-SHA256 is available from the JDK, avoids adding new dependencies, and directly addresses the vulnerable password hashing behavior with minimal code and
dependency changes.

[sonarqubecloud]

Quality Gate passed

Issues
2 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud