Set auto password hasher for all user classes

[fritzmg]

In Symfony 5.3 this config was added to the default security config in order to enable the auto password hasher for all user classes that implement this interface (see symfony/recipes#981) - which Contao\User also implements.

I think we should do the same in the contao/managed-edition. This way you don't have to define this yourself in case you are using HTTP Basic Authentication for some controller outside Contao's own firewalls. For instance, in this example the line

$extensionConfig['password_hashers'][InMemoryUser::class] = 'auto';

could be omitted then.

[aschempp]

that would mean we'll change the default config of existing systems, right? And if they would reconfigure this (e.g. for another firewall) it would no longer apply to Contao?

[Toflar]

Just for the ME which imho is a good default. But I'm also fine with leaving it as is.

[fritzmg]

And if they would reconfigure this (e.g. for another firewall) it would no longer apply to Contao?

Yeah, that's a good point. We could add both though.

[aschempp]

I would be in favor of adding both.

[leofeyer]

@fritzmg Can you please also update the core-bundle/README.md and the core-bundle/tests/Functional/app/config/security.yaml files?

[leofeyer]

Thank you @fritzmg.