Set usedforsecurity=False in hashlib methods (FIPS compliance)

[Wauplin]

This PR aims to make huggingface_hub (and then other libraries from HF-ecosystem) FIPS-compliant.

Issue was first raised by @DueViktor in huggingface/transformers#27034 and huggingface/transformers#27038.

Quoting @DueViktor:

Transformers use MD5 from hashlib, which is not a secure algorithm, but are not specifying that it is for other purposes than security. This is causing issues for organisations following certain security standard. FIPS compliance could be an example.

From https://docs.python.org/3/library/hashlib.html:

Changed in version 3.9: All hashlib constructors take a keyword-only argument usedforsecurity with default value True. A false value allows the use of insecure and blocked hashing algorithms in restricted environments. False indicates that the hashing algorithm is not used in a security context, e.g. as a non-cryptographic one-way compression function.

This PR copies what has been done in mlflow/mlflow#10106 and mlflow/mlflow#10119. We define a insecure_hashlib module that sets usedforsecurity=False by default in their hash methods. Usage is pretty much the same as hashlib:

# Use
from huggingface_hub.utils.insecure_hashlib import sha256
# instead of
from hashlib import sha256

# Use
from huggingface_hub.utils import insecure_hashlib
# instead of
import hashlib

---

Once this is merged, the plan is to make a release and then integrate in third-party libraries from the HF-ecosystem (starting by transformers, diffusers, datasets and evaluate). Thanks a lot @DueViktor for raising the question 👍 🙏

[HuggingFaceDocBuilderDev]

The documentation is not available anymore as the PR was closed or merged.

[LysandreJik]

Thanks for working on this @Wauplin!

[Wauplin]

Cool, thanks for the reviews. I'll merge :)