security: batch 10 (develop) - batch-10 GHSAs under 1.2.32 CHANGELOG (#8158)

* security: batch 10 (develop) - list batch-10 1.2.x GHSAs under the 1.2.32 CHANGELOG release

* security: batch 10 (develop) - credit GHSA-p5xj under 1.2.32 (90-day remember-me cap via login predicate + authcache_purge)

* security(GHSA-p3rg-7pc3-2h86): gate unknown-user dummy verify on non-empty password

The known-user path in LocalAuthLoginProvider::verifyCredential() skips compat_password_verify() when the submitted password is empty, but the unknown-user branch always ran the bcrypt dummy verify. An empty-password request therefore exposed a reversed timing distinction (known user fast, unknown user slow) that still leaked username validity. Gate the dummy verify on the same non-empty condition as the real path so timing matches for both empty and non-empty passwords, fully closing the enumeration side channel claimed in the 1.2.32 CHANGELOG entry.

---------

Co-authored-by: Larry Adams <TheWitness@users.noreply.github.com>

CHANGELOG

@@ -413,6 +413,17 @@ Cacti CHANGELOG
 -feature#7681: Add fail2ban support with a stable authentication-failure log line and a bundled filter
 
 1.2.32
+-security#GHSA-p3rg-7pc3-2h86: Dummy-verify passwords for unknown users to close a login-timing enumeration side channel
+-security#GHSA-92jm-r83q-cjr8: Validate the hgd graph-template id as a number before the tree-view graph SQL filter
+-security#GHSA-4j2v-vxgp-83ch: Validate the hgd graph-template id for host-leaf Graph Template grouping before the SQL filter
+-security#GHSA-q46f-rxh6-8pw2: Bind the reverse-DNS hostname when updating automation_ips
+-security#GHSA-gf3f-mwjj-vj2v: Validate the automation tree rule item field against existing columns before storage
+-security#GHSA-jv53-qfw3-v2fh: Validate the automation graph rule item field against existing columns before storage
+-security#GHSA-mgcq-r6vm-4xhw: Escape SNMP and Data Query names in Reports tree titles
+-security#GHSA-v2mq-mxpw-55pf: Escape graph preset names rendered in the gprint presets list
+-security#GHSA-4fr7-45gj-5cx6: Validate and escape data_source_path before RRDtool execution
+-security#GHSA-fgwr-944r-wg98: Validate rrd and data_source path tokens in the CLI maintenance tools and Boost
+-security#GHSA-p5xj-48vc-mqrf: Cap remember-me token lifetime to 90 days via the login-time predicate and the poller_maintenance authcache purge
 -security#GHSA-69vw-qxxv-p8w2: Remove the No Authentication mode and stop auto-granting an admin session for a legacy auth_method=0
 -security#GHSA-jpf3-w6p4-pjrf: Validate the automation tree rule item field against existing columns before storage
 -security#GHSA-4p7f-qcc2-vmx7: Escape path_php_binary in the resource-cache PHP syntax-check system() call