Update rfc28981.cs example

[wfurt]

updates based on https://developercommunity.visualstudio.com/t/Rfc2898DeriveBytes-Class-Microsoft-Learn/10547811 feedback

removes use of obsolete methods.

Fixes #9657

[ghost]

Tagging subscribers to this area: @dotnet/area-system-security, @vcsjones
See info in area-owners.md if you want to be subscribed.

Issue Details

---

updates based on https://developercommunity.visualstudio.com/t/Rfc2898DeriveBytes-Class-Microsoft-Learn/10547811 feedback

removes use of obsolete methods.

Author:	wfurt
Assignees:	wfurt
Labels:	area-System.Security
Milestone:	-

[learn-build-service-prod]

Learn Build status updates of commit f158a39:

✅ Validation status: passed

File	Status	Preview URL	Details
snippets/csharp/System.Security.Cryptography/Rfc2898DeriveBytes/Overview/rfc28981.cs	✅Succeeded	View

For more details, please refer to the build report.

For any questions, please:

• Try searching the learn.microsoft.com contributor guides
• Post your question in the Learn support channel

[bartonjs]

SNIPPET3's comment and SNIPPET4's usage were consistent: the default value is 1000, so specifying 1000 explicitly produces the same answer.
https://source.dot.net/#System.Security.Cryptography/System/Security/Cryptography/Rfc2898DeriveBytes.cs,45

Now that SNIPPET4 is no longer using a default iteration count, the comment in SNIPPET3 doesn't make sense.

I recommend bumping the iteration count 600_000, and changing the comment to express that the iteration count should be high enough to resist brute forcing, but low enough that you're willing to wait that long. The 600k number comes from OWASP (when using SHA-2-256), which comes out to about 0.33 seconds on my computer using the static span-writing functions .NET 8, or about 0.38 when using the instance array-returning functions. (.NET Framework is slower; 600k there is 1.6 seconds; so it gets 0.3 seconds around 130k)

[gewarren]

@wfurt Do you plan to keep working on this PR?