bcrypt cost (log rounds) for new hashes. Default: 10.
Each step up doubles the time. Allowed: 4 to 31.
Old hashes keep their own cost, so they still verify.
true when a and b are the same. It takes the same time for
any two values of the same length, so the time does not tell how
much of a secret (an API key, a token) was right.
has the password using BCrypt technique.
A password over maxBytes (72) bytes throws an ArgumentError.
The error text does not hold the password, so it is safe to log.
Limit the length in your DTO, like max(72).