Document PBKDF2 security

Most password managers used 100k until recently for the weaker sha256
version. We used 500k for the sha512 variant, so we should be good for a
while. Hopefully Matrix switches to argon2 or something better at that
point.