Use hmac for token hashes to avoid collisions

[ceeram]

Use hmac for token hashes to avoid collisions,
Also includes changes of #11151 now, making token hash user specific to avoid privilege escalation

[markstory]

We'll have to mention in the release notes that security component tokens changed, and that existing tokens will become invalid.

[codecov-io]

Codecov Report

Merging #11101 into master will increase coverage by 0.14%.
The diff coverage is 100%.

@@             Coverage Diff              @@
##             master   #11101      +/-   ##
============================================
+ Coverage     94.89%   95.03%   +0.14%     
- Complexity    12841    13336     +495     
============================================
  Files           437      437              
  Lines         32742    34026    +1284     
============================================
+ Hits          31070    32338    +1268     
- Misses         1672     1688      +16

Impacted Files	Coverage Δ	Complexity Δ
src/View/Helper/SecureFieldTokenTrait.php	100% <100%> (ø)	4 <0> (ø)	⬇️
src/Controller/Component/SecurityComponent.php	98.68% <100%> (ø)	95 <0> (ø)	⬇️
src/Form/Form.php	91.3% <0%> (-2.64%)	20% <0%> (+4%)
src/View/Helper/TextHelper.php	98.49% <0%> (-0.32%)	48% <0%> (+24%)
src/View/View.php	99.16% <0%> (-0.03%)	231% <0%> (+87%)
src/ORM/Table.php	100% <0%> (ø)	282% <0%> (+11%)	⬆️
src/Auth/DigestAuthenticate.php	100% <0%> (ø)	64% <0%> (+32%)	⬆️
src/TestSuite/ConsoleIntegrationTestCase.php	100% <0%> (ø)	46% <0%> (+21%)	⬆️
src/I18n/Parser/PoFileParser.php	100% <0%> (ø)	21% <0%> (+2%)	⬆️
src/I18n/RelativeTimeFormatter.php	95.02% <0%> (ø)	74% <0%> (ø)	⬇️
... and 8 more

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update e5808ba...49f3674. Read the comment docs.

[ceeram]

Additional PR created targeting this PRs branch see #11151

[markstory]

Moving to 3.6 as the risk of breaking user form submissions is high enough.