GHSA-fm4g-76c9-7w69: Http4s: DigestAuth nonce map grows unbounded

The `DigestAuth` server middleware's stale-nonce cleanup uses an inverted comparison: it removes *fresh* nonces and stops at the first *stale* one. Because a new nonce is created for every unauthenticated challenge, an attacker can drive the nonce map to grow without bound until the JVM runs out of heap. ## Impact Unauthenticated remote denial of service (gradual heap exhaustion / OOM) against any service using DigestAuth. The leak is persistent. ## Preconditions - Application uses `DigestAuth` on at least one route. …