s4:dsdb/password_hash: split out a password_hash_needed() function