Validate strings before native access

[OskarEichler]

Summary:

• coerce password and salt once before accessing Ruby string internals
• use RSTRING_PTR after validation instead of mixing StringValuePtr and RSTRING_LEN in one call expression
• apply the same validation to the low-level hash entry point

Why:
Passing a non-string such as false to __bc_crypt_hash currently reaches RSTRING_LEN without validation and can crash MRI. The PBKDF call also combines coercion and length access in one expression, leaving evaluation order unsafe and potentially inconsistent for coercible objects.

Verification:

• existing current suite: 8 runs, 31 assertions, 0 failures
• false/non-string crash reproduction now raises TypeError instead of exiting with signal 11
• to_str coercion remains supported
• native extension builds warning-free on Ruby 4.0.6

Compatibility:
Valid string inputs and the public Engine.hash_secret behavior are unchanged. Invalid low-level non-string inputs now raise TypeError rather than invoking undefined native access.