Make Default Password Alg. settable on the install page

[6543]

... we just move back to pbkdf2 but make it settable on the install page with warnings about the issues.

Originally posted by @zeripath in #14294 (comment)

[CirnoT]

we just move back to pbkdf2

Please think very carefully about this - this is a clear downgrade in term of security that everyone upgrading will need to address themselves and adjust config accordingly if they don't wish to accept it. Make sure that if you proceed with reverting default algo to pbkdf2, it is clearly communicated in release notes along with example given to users on how to avoid this change happening.

but make it settable on the install page with warnings about the issues.

Nothing against this

[zeripath]

There's a balance here.

Argon2 is clearly causing multiple problems.

I cannot recommend argon2 in good conscience at present.

I agree we need to make this very clear on the blog post releasing the version as it clearly is extreme

[lunny]

We should notice that on our release notes of v1.13.3 and v1.14.0 .
And we also need an option on install page where we can detect the server's total memory to recommend one algorithm. For memory > 2GB we can recommend argon2 and otherwise pbkdf2 and user still change it to scrypt and others.

And this is only default algorithm, users could still change them on configuration file.