This allows password to be automatically rehashed if the database is old

This is so that we can drop support for submit and register for old
clients, which use 3.0

This is required to properly migrate away from md5, as old clients
performed hashing on client side.

- Passwords are now hashed on the server, with a salt.

- After the database update has run, for old accounts we are left with
their old md5 hash rehashed using argon2id, so to verify their password,
we hash first using md5 and then rehash with argon2id.

This way we can gradually remove the rehashed md5 hashes

This test results in a request to lib.haxe.org, which does not provide
api version 4.0 yet

This will be done via sql statements for now, because I'm not sure
how to run `skeema push` automatically.