We've been using ozh/phpass for a super long time because back then when dealing with PHP prior to 5.5 we didn't have builtin functions password_hash() and password_verify().

We can, so we should, remove this dependency and use password_hash(), which should be a straightforward replacement in includes/functions-auth.php and in the unit tests.

Things to ponder :

• we could use PASSWORD_BCRYPT by default and allow another hashing algorithm with a filter
• do we really need that $ <-> ! replacement ?

Note : the bcrypt hash is limited to 72 chars, see https://stackoverflow.com/questions/16594613/how-to-hash-long-passwords-72-characters-with-blowfish (note that ozh/phpass behaves the same, see https://3v4l.org/F6NvW).
Now, passwords longer than 72 chars shouldn't be an issue I guess, but it may be worth documenting it somewhere (there's got to be some zealot one day with a password manager who will use a 128 char long password, obviously) (Other hashing algorithm don't have that limitation)