[Security][P0] Replace/contain MD5 auth hashing usage in www-authenticate patch

[ngodugu-marklogic]

Summary

Address cryptographic findings tied to MD5 usage in authentication helper code.

Source

• Nia Security Audit: .nia/work/job_MLE-31213/security/audit_report.md
• CodeQL alerts around lib/www-authenticate-patched/md5.js

Risks

• Broken cryptographic primitive (CWE-327)
• Insufficient password hash computational effort (CWE-916)

Scope

• Review protocol requirements for digest authentication.
• Replace MD5 where not protocol-mandated.
• Isolate/document unavoidable legacy MD5 usage if protocol compatibility requires it.
• Add guardrails/tests to ensure helper is not reused for password/token hashing.

Acceptance Criteria

• Cryptography findings remediated or explicitly triaged with documented protocol rationale.
• Regression tests pass.

Validation

• npm run test:types
• npm run test:compile
• npm run test:typescript
• nia sec audit