Security fix: challenge tokens are now signed by the server
Sites running 1.0.0-alpha2 or earlier should update.
Tokens are now issued server-side and signed with an HMAC over their expiry, keyed on the site hash salt, and verified with hash_equals(). The challenge page hands the signed token to the client, which only stores it.
Existing tokens are invalidated by this release. Visitors will see the challenge page once more, then continue as normal.
#3577557: Move file generation to ConfigEvents::SAVE event subscriber. Static files (challenge.html, protected-paths.json) are now regenerated on any config save, not just form submission. This fixes the bug where config import via Drush wouldn't generate the required files.
Simplified SecuritySettingsForm to pure ConfigFormBase.
