Use PasswordKey for storing transformed secrets.

The transformed secrets were stored in normal QByteArrays,
which are at risk of being swapped out. We now use secure
PasswordKey objects instead. There are still a few areas
where QByteArrays are used for storing secrets, but since
they are all temporary, they are less critical. It may be
worth hunting those down as well, though.

src/keys/PasswordKey.cpp

@@ -48,19 +48,29 @@ PasswordKey::~PasswordKey()
     }
 }
 
-QSharedPointer<PasswordKey> PasswordKey::fromRawKey(const QByteArray& rawKey)
-{
-    auto result = QSharedPointer<PasswordKey>::create();
-    std::memcpy(result->m_key, rawKey.data(), std::min(SHA256_SIZE, rawKey.size()));
-    return result;
-}
-
 QByteArray PasswordKey::rawKey() const
 {
+    if (!m_isInitialized) {
+        return {};
+    }
     return QByteArray::fromRawData(m_key, SHA256_SIZE);
 }
 
 void PasswordKey::setPassword(const QString& password)
 {
-    std::memcpy(m_key, CryptoHash::hash(password.toUtf8(), CryptoHash::Sha256).data(), SHA256_SIZE);
+    setHash(CryptoHash::hash(password.toUtf8(), CryptoHash::Sha256));
+}
+
+void PasswordKey::setHash(const QByteArray& hash)
+{
+    Q_ASSERT(hash.size() == SHA256_SIZE);
+    std::memcpy(m_key, hash.data(), std::min(SHA256_SIZE, hash.size()));
+    m_isInitialized = true;
+}
+
+QSharedPointer<PasswordKey> PasswordKey::fromRawKey(const QByteArray& rawKey)
+{
+    auto result = QSharedPointer<PasswordKey>::create();
+    result->setHash(rawKey);
+    return result;
 }