Hash a string with SHA-256 and render it as a short, URL-safe string of the requested length.
The alphabet is base64 with + and / swapped for - and _ and the padding dropped, so the result is
safe in URLs and identifiers. Shorter lengths raise the chance of collisions.
hashBySize