* security: batch 10 (develop) - list batch-10 1.2.x GHSAs under the 1.2.32 CHANGELOG release
* security: batch 10 (develop) - credit GHSA-p5xj under 1.2.32 (90-day remember-me cap via login predicate + authcache_purge)
* security(GHSA-p3rg-7pc3-2h86): gate unknown-user dummy verify on non-empty password
The known-user path in LocalAuthLoginProvider::verifyCredential() skips compat_password_verify() when the submitted password is empty, but the unknown-user branch always ran the bcrypt dummy verify. An empty-password request therefore exposed a reversed timing distinction (known user fast, unknown user slow) that still leaked username validity. Gate the dummy verify on the same non-empty condition as the real path so timing matches for both empty and non-empty passwords, fully closing the enumeration side channel claimed in the 1.2.32 CHANGELOG entry.
---------
Co-authored-by: Larry Adams <TheWitness@users.noreply.github.com>
