Increase default salt length from 8 to 16 bytes in PKCS#8 and PKCS#12

Currently, PKCS#8 and PKCS#12 encryption use a salt length of 8 bytes
(64 bits) when no salt length is specified. Increase this default to
16 bytes (128 bits), as recommended by NIST SP 800-132.

Update-Note: PKCS8_encrypt and PKCS8_marshal_encrypted_private_key
will now, if no salt length is specified, default to a salt length of
16 bytes. PKCS12_create will use a salt length of 16 bytes for both
encryption and the MAC.

Fixed: 416889523
Change-Id: I91a496e4856296f07b5445592fb6ecdc41ee718c
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/79267
Reviewed-by: David Benjamin <davidben@google.com>
Reviewed-by: Adam Langley <agl@google.com>
Commit-Queue: David Benjamin <davidben@google.com>

crypto/pkcs8/internal.h

diff --git a/crypto/pkcs8/internal.h b/crypto/pkcs8/internal.h
index 06f17a6..cde6c3d 100644
--- a/crypto/pkcs8/internal.h
+++ b/crypto/pkcs8/internal.h
@@ -74,7 +74,7 @@
                       const char *pass, size_t pass_len, CBS *param);
 };
 
-#define PKCS5_SALT_LEN 8
+#define PKCS5_SALT_LEN 16
 
 // pkcs5_pbe2_nid_to_cipher returns the |EVP_CIPHER| for |nid| if |nid| is
 // supported with PKCS#5 PBES2, and nullptr otherwise.