CVE-2026-85716: AsyncHttpClient doesn't verify SCRAM and Digest mutual-authentication responses

For SCRAM, and for Digest with mutual authentication, the client computes the server’s verification value (the SCRAM ServerSignature, or the Digest rspauth) but does not act on the result. If the value is present and does not verify, the client only logs it and still delivers the response to the application as a successful, authenticated result. A server that never proved knowledge of the shared secret is accepted, so the client loses its ability to detect an impostor. Over TLS the real server always returns a valid value and the issue is inert; it matters over a non TLS transport, or when the transport is already compromised, where it removes the client’s only signal that the peer does not know the secret.