Problem with preference hashing

[yuyichao]

Ref JuliaLang/PrecompileTools.jl#67 (comment)

There appears to be a few issues with get_perferences_hash and its use to determine if a precompiled cache is usable for a particular preference setting.

1. In general, using a non-cryptographic hash here is in general prone to hash collision, as the case in the linked PrecompiledTools issue shows.
2. The hash used by Base.hash is required to return the same value for isequal values. This means that the hash is intrinsically not able to distinguish between values like true, 1, 1.0, no matter what hash algorithm Base uses or hash combination algorithm get_perferences_hash uses. Such value differences could make a difference for the user of the perference values in principle.
3. get_perferences_hash also only hash the list of non-nothing preference values and doesn't include the keys in the hash. This means that two preference dicts with different keys but the same (non-nothing) values could produce the same hash as well.

Personally I feel like a time-stamp system is probably more reliable and its inline with how file tracking works. Else a more secure hash function that can distinct isequal values should be used instead.

[yuyichao]

Dup of #59344