GHSA-c476-6w5q-jw77: rclone: FTP cross-session auth-proxy backend confusion

## Summary The FTP auth-proxy driver stores one obscured password per username in a server-wide map. It does not bind the credential or returned VFS to the authenticated FTP session. If two accepted credentials use the same username but resolve to different proxy backends, the later login overwrites the map entry. Subsequent operations on the first, still-authenticated session are re-authorized with the later session's password and execute against the later session's backend. This is not exploitable in every auth-proxy deployment. …