CVE-2025-6547: pbkdf2 silently disregards Uint8Array input, returning static keys

On historic but declared as supported Node.js versions (0.12-2.x), pbkdf2 silently disregards Uint8Array input

This only affects Node.js <3.0.0, but pbkdf2 claims to:

• Support Node.js >= 0.12 (and there seems to be ongoing effort in this repo to maintain that)
• Support Uint8Array input (input is typechecked against Uint8Array, and the error message includes e.g. “Password must be a string, a Buffer, a typed array or a DataView”