[GHSA] GHSA-fm4g-76c9-7w69 (high) — Http4s: DigestAuth nonce map grows unbounded

GHSA-fm4g-76c9-7w69 Severity: high CVE: CVE-2026-69208

Http4s: DigestAuth nonce map grows unbounded

The `DigestAuth` server middleware's stale-nonce cleanup uses an inverted comparison: it removes *fresh* nonces and stops at the first *stale* one. Because a new nonce is created for every unauthenticated challenge, an attacker can drive the nonce map to grow without bound until the JVM runs out