Security component adjustments: fixed comment style, hkdf() and pbkdf2() are now protected, compareString() is now public

Fixes #4114: Added Security::generateRandomHexKey(), used it for various tokens and default key generation

issue #2852

Why use a strong random number generator in one place, but not another? I know salts have no cryptographic security requirement, but collisions are less likely if you use one.

$cost must be in range 4-31.

prevent call strlen function twice

Moved file and path related methods from StringHelper to FileHelper, renamed StringHelper byte methods not to be misused as string methods