ext/standard: notice on long passwords in bcrypt

[Sjord]

Bcrypt supports passwords up to 72 characters. The remainder is ignored.

Earlier proposed here:

• https://news-web.php.net/php.internals/75692
• https://wiki.php.net/rfc/password_hash_spec

Bcrypt truncation can result in serious security bugs:

• https://pentesterlab.com/blog/freshrss-bcrypt-truncation-auth-bypass
• https://www.invicti.com/blog/web-security/okta-vulnerability-bcrypt-auth

[Sjord]

This could also apply to crypt. However, with crypt there is not a distinction between creating the hash and verifying the hash, as there is with password_hash / password_verify, which means that anyone that can access to login screen can trigger the notice by entering a long password. That makes the notice less meaningful and bigger chance of BC break.