Ensure challenge-response key buffer is properly cleared.

The challenge-response key buffer is explicitly cleared
before the key transformation if no such key is configured
to ensure one is never injected into the hash even if the
database had a challenge-response key previously.

This patch also adds extensive tests for verifying that a
key change will not add any expired key material to the hash.

Fixes #4146

src/core/Database.cpp

@@ -651,6 +651,9 @@ bool Database::challengeMasterSeed(const QByteArray& masterSeed)
         bool ok = m_data.key->challenge(masterSeed, response);
         if (ok && !response.isEmpty()) {
             m_data.challengeResponseKey->setHash(response);
+        } else if (ok && response.isEmpty()) {
+            // no CR key present, make sure buffer is empty
+            m_data.challengeResponseKey.reset(new PasswordKey);
         }
         return ok;
     }