*: add back salt

[xhebox]

Signed-off-by: xhe xw897002528@gmail.com

What problem does this PR solve?

Issue Number: close None

Problem Summary: The fake salt does not have any usage. But client will still send the computed passwords with the fake salt in the response. In cases of non-TLS, all-zero salt will let client send a fixed auth string(sha1 three times with fixed input), which is highly insecure. Thus we should still send random salt instead.

Check List

Tests

• Unit test
• Integration test
• Manual test (add detailed scripts or steps below)
• No code

Notable changes

• Has configuration change
• Has HTTP API interfaces change (Don't forget to add the declarative for API)
• Has tiproxyctl change
• Other user behavior changes

Release note

Please refer to Release Notes Language Style Guide to write a quality release note.

None