Migrate VCS passwords to new shared password infrastructure

Summary:
Ref T13043. Migrate VCS passwords away from their dedicated table to new the new shared infrastructure.

Future changes will migrate account passwords and remove the old table.

Test Plan:
- Ran migrations.
  - Cloned with the same password that was configured before the migrations (worked).
  - Cloned with a different, invalid password (failed).
- Changed password.
  - Cloned with old password (failed).
  - Cloned with new password (worked).
- Deleted password in web UI.
  - Cloned with old password (failed).
- Set password to the same password as it currently is set to (worked, no "unique" collision).
- Set password to account password. !!This (incorrectly) works for now until account passwords migrate, since the uniqueness check can't see them yet.!!
- Set password to a new unique password.
  - Cloned (worked).
  - Revoked the password with `bin/auth revoke`.
  - Verified web UI shows "no password set".
  - Verified that pull no longer works.
  - Verified that I can no longer select the revoked password.
- Verified that accounts do not interact:
  - Tried to set account B to account A's password (worked).
  - Tried to set account B to a password revoked on account A (worked).
- Spot checked the `password` and `passwordtransaction` tables for saniity.

Reviewers: amckinley

Reviewed By: amckinley

Maniphest Tasks: T13043

Differential Revision: https://secure.phabricator.com/D18898

src/applications/diffusion/controller/DiffusionServeController.php

@@ -715,30 +715,19 @@ final class DiffusionServeController extends DiffusionController {
       return null;
     }
 
-    $password_entry = id(new PhabricatorRepositoryVCSPassword())
-      ->loadOneWhere('userPHID = %s', $user->getPHID());
-    if (!$password_entry) {
-      // User doesn't have a password set.
+    $request = $this->getRequest();
+    $content_source = PhabricatorContentSource::newFromRequest($request);
+
+    $engine = id(new PhabricatorAuthPasswordEngine())
+      ->setViewer($user)
+      ->setContentSource($content_source)
+      ->setPasswordType(PhabricatorAuthPassword::PASSWORD_TYPE_VCS)
+      ->setObject($user);
+
+    if (!$engine->isValidPassword($password)) {
       return null;
     }
 
-    if (!$password_entry->comparePassword($password, $user)) {
-      // Password doesn't match.
-      return null;
-    }
-
-    // If the user's password is stored using a less-than-optimal hash, upgrade
-    // them to the strongest available hash.
-
-    $hash_envelope = new PhutilOpaqueEnvelope(
-      $password_entry->getPasswordHash());
-    if (PhabricatorPasswordHasher::canUpgradeHash($hash_envelope)) {
-      $password_entry->setPassword($password, $user);
-      $unguarded = AphrontWriteGuard::beginScopedUnguardedWrites();
-        $password_entry->save();
-      unset($unguarded);
-    }
-
     return $user;
   }