Add fallback routines for empty secret cases

[juliushaertl]

Make sure to keep authentication working when an instance has been setup without a secret after adding the secret manually afterwards.

• Password auth to webdav still works
• App password auth to webdav still works
• Browser session keeps being active
• PublicKeyTokens get rotated if the fallback is hit so their private key is reencrypted with the secret now

Provides a possible migration path for #31492

ToDo

• Add migration step to update the config if possible and set a secret before the upgrade
  • secret
  • paswordsalt

[juliushaertl]

Test results when having an instance without a secret and adding one afterwards:

• Users get logged out of their sessions in the browser
• Reauthentication with existing password works -> password salt change is confirmed to not be an issue
• App passwords still fail

[juliushaertl]

Retested with follow up commits:

• Password auth to webdav still works
• App password auth to webdav still works
• Browser session keeps being active
• PublicKeyTokens get rotated if the fallback is hit so their private key is reencrypted with the secret now

[CarlSchwan]

Code looks good and I tested it manually and I didn't get logged when moving from a config without secret to a config.php with a secret

[CarlSchwan]

Should we merge it without the migration path and just add the warning from #31492 instead?

It's better than the current state

[CarlSchwan]

/backport to stable25

[CarlSchwan]

Manual backport #35605