Security fixes

[gpappsoft]

security fixes:

• Race condition Added sync.RWMutex to ChallengeStateStore — all Get/Set/Delete operations are now synchronized
• Secret logging Removed RADIUS shared secrets, passwords, OTPs, client secrets, and response bodies from log output
• OTP bypass Passwords <= 6 chars now get rejected instead of authenticating with an empty password
• Auth on parse error AuthenticateUser now returns false + error when JSON unmarshal fails, instead of true
• Predictable state GenerateRandomState returns an error instead of falling back to deterministic bytes
• Ignored errors http.NewRequest errors are now checked and propagated

removed:

• remove mschapv2 feature

additions:

• dev issue Feature: add support of VendorID #4