[3.0] Upgrader login fixes

[Sesquipedalian]

Partial fix for #9293

1. Security fix: uses hash_equals() in SMF\Maintenance\Maintenance::loginAdmin() and SMF\Maintenance\Maintenance::loginWithDatabasePassword() methods.
2. Logs correct info about who ran the upgrader. Previously, we were doing some silly things with loading and unloading User::$me. Not only was that unnecessary, and not only could it produce inaccurate info in the logs under certain circumstances, but it also further complicated the problems with getting the admin's login cookie right by the time the upgrade was complete.
3. Moves SMF\Actions\Login2::validatePasswordFlood() to SMF\Security::validatePasswordFlood().
4. Implements SMF\Security::checkPassword().
5. Updates the admin's stored password value and updates their login cookie as needed during upgrade.
6. Fixes bugs with handling login security tokens in the upgrader.
7. Point 6 ultimately led to replacing Maintenance::$context with just plain old Utils::$context. Upon closer inspection, I realized that there was neither any need nor any benefit to having a separate version of $context; it just caused headaches when using other code, such as SecurityToken::create(), that is already designed to work with Utils::$context.

[Sesquipedalian]

Okay, I think I am done messing with this PR.

@sbulen, would you care to test whether it solves the problem of not being logged after the upgrader exits?

[sbulen]

2.1 => 3.0

Fatal error: Uncaught Error: Cannot access uninitialized non-nullable property SMF\User::$username by reference in D:\wamp64\www\van2130\Sources\User.php:807 Stack trace: # 0 [internal function]: SMF\User->$member_name::get() # 1 D:\wamp64\www\van2130\Sources\Utils.php(1539): json_encode(Array, 0, 512) # 2 D:\wamp64\www\van2130\Sources\Services\ErrorHandlerService.php(286): SMF\Utils::jsonEncode(Array) # 3 D:\wamp64\www\van2130\Sources\Services\ErrorHandlerService.php(185): SMF\Services\ErrorHandlerService->log('Cannot access u...', 'general', 'D:/wamp64/www/v...', 807, Array) # 4 D:\wamp64\www\van2130\Sources\ErrorHandler.php(104): SMF\Services\ErrorHandlerService->catch(Object(Error)) # 5 [internal function]: SMF\ErrorHandler::catch(Object(Error)) # 6 {main} thrown in D:\wamp64\www\van2130\Sources\User.php on line 807

• PHP, MySQL, Apache logs: nothing
• Upgrader log: nothing

[Sesquipedalian]

Well, phooey. I must have broken something in my tinkering after I first pushed. I suppose that's what I get for trying to code while sleepy.

[Sesquipedalian]

@sbulen:

1. I've made changes to this PR. Have they fixed the error about uninitialized properties?
2. If so, does this PR solve the problem of not being logged after the upgrader exits?

[sbulen]

2.1 => 3.0

Getting a different WSOD:

Fatal error: Uncaught Error: Call to a member function allowedTo() on array in D:\wamp64\www\van2130\Sources\Maintenance\Maintenance.php:661 Stack trace: 0 D:\wamp64\www\van2130\Sources\Maintenance\Tools\Upgrade.php(819): SMF\Maintenance\Maintenance::loginAdmin('admin_shawnb', Object(SensitiveParameterValue), false) 1 D:\wamp64\www\van2130\Sources\Maintenance\Maintenance.php(294): SMF\Maintenance\Tools\Upgrade->welcomeLogin() 2 D:\wamp64\www\van2130\upgrade.php(24): SMF\Maintenance\Maintenance->execute(2) 3 {main} thrown in D:\wamp64\www\van2130\Sources\Maintenance\Maintenance.php on line 661

PHP error log reflects the above. MySQL & Apache logs clear.

Upgrade.log:

2026-08-08T17:11:08+00:00
Step 1: Login
Making sure SMF can write to "D:\wamp64\www\van2130\Settings.php"... done.
Making sure SMF can write to "D:\wamp64\www\van2130\Settings_bak.php"... done.
Making sure SMF can write to "D:\wamp64\www\van2130/custom_avatar"... done.
Making sure SMF can write to "D:/wamp64/www/van2130/cache/db_last_error.php"... done.