This is to address a deprecation planned for PHP 8.4.

https://wiki.php.net/rfc/deprecate-implicitly-nullable-types

This is essentially https://gitlab.tt-rss.org/wn/tt-rss/-/commit/1ccc0c8c1af04dd9654b585c6d07e3a75d944a0c without the renames and some other things related to Psalm.

 * expose said methods via CLI (update.php)
 * fix several invocations of deprecated functions
 * set stricter type hints on several method arguments

PHPStan was complaining in 'plugins/auth_internal/init.php' due to UserHelper::hash_password() being passed a string, rather than a UserHelper::HASH_ALGO_* constant.  Just switching the param to string for now.

 - read only - can't subscribe to more feeds, feed updates are skipped
 - disabled - can't login
define used access levels as UserHelper constants and refactor code to
use them instead of hardcoded numbers

Avoid "E_NOTICE (8) (classes/userhelper.php:78) Undefined index:
csrf_token" in logs.

different agent headers for whatever reason, example:

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML,
like Gecko) Chrome/88.0.4324.192 Safari/537.36

Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like
Gecko) Chrome/88.0.4324.104 Safari/537.36

seems to be related, at least, to App.postOpenWindow() hack.

* move most OTP-related stuff into userhelper
* remove old phpqrcode and otphp libraries