CVE-2026-54148: http4k: `DigestAuthProvider.verify` did not bind to request URI

An issue in DigestAuthProvider.verify:

The uri parameter in the client’s Authorization: Digest … response was not checked against the actual request URL. A captured Digest authentication response could be replayed against any other URL served by the same realm, breaking the per-request-URL binding the Digest scheme assumes.

Who is affected: any application using http4k-security-digest for HTTP Digest authentication. The bug has been present since DigestAuthProvider was introduced (commit 8a52b615b1, 2021).