fix(auth): enforce RFC-compliant SASL mechanisms

[mbuckton]

Summary

• restrict the provider and factories to the registered SCRAM-SHA-256 and PLAIN mechanism names
• implement the RFC 7677 SCRAM transcript, proof, server verifier, nonce, iteration, SASLprep, authorization, and lifecycle rules
• implement RFC 4616 PLAIN framing, UTF-8 validation, authorization identity handling, constant-time credential comparison, and lifecycle rules
• honor SASL QOP/security policy properties and remove the non-standard XOR security layer
• preserve the existing public signatures and legacy generated accessors; new surface is additive

Security behavior

• unsupported, discovered, bcrypt-prefixed, SHA-1, SHA-512, SHA-3, CRAM-MD5, and DIGEST-MD5 names are no longer advertised or selected
• SCRAM requires a reversible password until a verifier callback/API is introduced
• malformed, duplicate, oversized, replayed, or out-of-order messages are rejected
• only auth QOP is negotiated

Verification

• exact RFC 7677 published proof and server-verifier vector
• Ongres SCRAM client interoperability test
• PLAIN RFC framing/UTF-8/authzid and malformed-message tests
• provider/factory allowlist and SASL policy tests
• focused Java 17 compilation and end-to-end SCRAM-SHA-256/PLAIN runtime exchanges

Full Maven resolution was unavailable in the managed environment because the project depends on the private Maps snapshot repository.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 4727a445-88fd-4861-85ba-aa81de62d17c

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}