VaultPassword should be deterministically derived from public key, policy ID and server salt

[RaghavSood]

In the normal flow, the vault password is stored on the user's device, and allows them ask a fast vault for server-signing.

In the plugin<>verification server flow, no user device is involved - we should instead allow the config to store a server salt, and use that value along with the public key and policy ID to generate a deterministic password.