Ensure SHA256 is not used in tests

[jkakavas]

SHA256 was recently added to the Hasher class in order to be used
in the TokenService. A few tests were still using values() to get
the available algorithms from the Enum and it could happen that
SHA256 would be picked up by these.
This change adds an extra convenience method
(Hasher#getAvailableAlgoCacheHash) and enures that only this and
Hasher#getAvailableAlgoStoredHash are used for getting the list of
available password hashing algorithms in our tests.

Resolves #42267

[elasticmachine]

Pinging @elastic/es-security

[jaymode]

my two cents is that we should probably make values for hasher a forbidden API or just change Hasher so that it is not an enum. It seems like it would be too easy for this to pop back up.

[jkakavas]

I contemplated other options too. I attempted to change this from an Enum when doing #31234 but circled back, not really sure what was the issue though. I also thought about moving the SHA256 to the TokenService as this is the only option with no salt ( well, NOOP too ).
I see your point and I think making values() a forbidden API makes sense. I don't worry that this will make it into a password hashing code since we use resolve and SHA256 is not available there, but it might well creep up to a test case with someone getting a random from Hasher.values() .

[jaymode]

but it might well creep up to a test case with someone getting a random from Hasher.values() .

This is what I was thinking of.

[talevy]

fyi, I found another test that relates to this and muted two related tests in #42304

[tvernum]

LGTM