Protected against missing NODE_ENV variable

- in the event NODE_ENV isn't set, this would throw an error because
  `startsWith` is a function call on `undefined`

ghost/security/lib/password.js

@@ -2,7 +2,7 @@ const bcrypt = require('bcryptjs');
 
 let HASH_ROUNDS = 10;
 
-if (process.env.NODE_ENV.startsWith('testing')) {
+if (process.env.NODE_ENV?.startsWith('testing')) {
     HASH_ROUNDS = 1;
 }