CVE-2026-54147: http4k: `DigestAuthProvider.verify` ignored configured algorithm and did not bind to request URI

An issue in DigestAuthProvider.verify:

Algorithm silently forced to MD5. The configured algorithm parameter was ignored — every verification used MD5 regardless of configuration. Deployments believing they were running SHA-256 Digest auth were silently inheriting MD5’s collision weaknesses, including documented attack paths against Digest schemes that rely on the hash being collision-resistant.

Who is affected: any application using http4k-security-digest for HTTP Digest authentication. The bug has been present since DigestAuthProvider was introduced (commit 8a52b615b1, 2021).