Add SHA256 as an algorithm option for Remember Me token hashing

[marcusdacoregio]

Closes gh-8549

[skjelmo]

I love it that this PR offers the possibility to configure a secure hashing algorithm for the Remember Me token 🙌

The possibility to use a secure hashing algorithm is way more important than the concern I'm raising here, but I assume this is the time and place to ask the following question.

I see from the previous PR that there was a suggestion to use setter ingestion with the argument that the hashing algorithm is an optional parameter.

I agree with the argument, and the parameter is obviously optional from the code's point of view. However, I'm not confident that the assumption holds when the default option is cryptographically insecure.

Would it not be better for users who needs a cryptographically secure hashing algorithm to have it be set as a final field with constructor injection, so that it could not be changed (downgraded to an insecure hashing algorithm) by a setter during runtime? Or is my concern way off?

The configuration would still be optional without a breaking change so that it doesn't have to wait until Spring Security 6.

Lastly, I really hope this PR makes it through the review process and into Spring Security. From what I can see, there has been 1, 2, 3, 4 PRs before this attempt to address #8549.

[jzheaux]

Great, @marcusdacoregio! I've left some inlined feedback.

[marcusdacoregio]

Thanks @jzheaux and @skjelmo.

The PR is updated with the suggested changes.