fix(Security): Don't attempt empty secret fallback on >=v3 ciphertext

[joshtrichards]

Summary

The v3 ciphertext format (added in #23496) has never worked with an empty secret/password. However, the v3 implementation was added prior to the existence of the empty secret fallback code added in #31499.

While looking into #34012 I noted that the only reason the hash_hkdf() PHP ValueError is occurring is because the fallback is being attempted not only anytime the initial decrypt attempt fails, but also against newer ciphertext versions (where the fallback isn't relevant).

This PR adjusts the fallback logic to only run against <=2 versioned or non-versioned (which is even older) ciphertext.

Note: This does not fix the underlying cause of #34012 (which is probably in at least most cases a configuration problem), but it does:

• clean-up the logic to avoid the PHP error
• avoids doing the fallback on newer ciphertext where it's pointless (and most ciphertext is probably v3 at this point)

References:

• Add fallback routines for empty secret cases #31499
• Require the secret config to be configured #31492
• Fixes related key issue. #23496
• Use random_bytes #20915

TODO

• Adjust the tests (since I also change one of the Exception strings)
• Add a test (for the fallback; I don't believe there is one but need to double-check again)

Checklist

• Code is properly formatted
• Sign-off message is added to all commits
• Tests (unit, integration, api and/or acceptance) are included
• Screenshots before/after for front-end changes
• Documentation (manuals or wiki) has been updated or is not required
• Backports requested where applicable (ex: critical bugfixes)

[joshtrichards]

/backport to stable29

[joshtrichards]

/backport to stable28

[come-nc]

Suggested change

	if ((!empty($version) && $version <= '2') || empty($version)) { // only <3 versioned or old non-versioned ciphertext ever supported empty secrets
	if (empty($version) || $version <= '2') { // only <3 versioned or old non-versioned ciphertext ever supported empty secrets

[come-nc]

Why is this removed?
Should be added back.