HaveIBeenPwnedRestApiPasswordChecker implementations are not thread-safe

[garvit-joshi]

HaveIBeenPwnedRestApiPasswordChecker stores a single MessageDigest instance as a field and reuses it across all invocations of check(). Since MessageDigest is not thread-safe, concurrent calls can produce incorrect hash values.

To Reproduce

1. Register HaveIBeenPwnedRestApiPasswordChecker as a singleton bean
2. Call check() concurrently from multiple threads
3. Hash computation becomes unreliable due to shared mutable state in MessageDigest

Expected behavior

The checker should produce correct results under concurrent access. A new MessageDigest instance should be created per invocation instead of reusing a shared instance.