deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-563x-q5rq-57qp
Package: org.apache.tomcat:tomcat-tribes (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Vulnerable versions: >= 10.1.0-M1, < 10.1.52
Patched in: 10.1.52

Summary: Apache Tomcat has an HTTP Request/Response Smuggling vulnerability

Details:
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat via invalid chunk extension.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M1 through 10.1.52, from 9.0.0.M1 through 9.0.115, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.
Other, unsupported versions may also be affected.

Users are recommended to upgrade to version 11.0.20, 10.1.52 or 9.0.116, which fix the issue.
GitHub Security Advisory: GHSA-563x-q5rq-57qp
Package: org.apache.tomcat:tomcat-tribes (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Vulnerable versions: >= 7.0.0, < 9.0.116
Patched in: 9.0.116

Summary: Apache Tomcat has an HTTP Request/Response Smuggling vulnerability

Details:
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat via invalid chunk extension.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M1 through 10.1.52, from 9.0.0.M1 through 9.0.115, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.
Other, unsupported versions may also be affected.

Users are recommended to upgrade to version 11.0.20, 10.1.52 or 9.0.116, which fix the issue.
GitHub Security Advisory: GHSA-69r9-qgr7-g2wj
Package: org.apache.tomcat:tomcat-tribes (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-311: Missing Encryption of Sensitive Data
Vulnerable versions: = 9.0.116
Patched in: 9.0.117

Summary: Apache Tomcat Missing Encryption of Sensitive Data vulnerability

Details:
Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor.

This issue affects Apache Tomcat: 11.0.20, 10.1.53, 9.0.116.

Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the issue.
GitHub Security Advisory: GHSA-69r9-qgr7-g2wj
Package: org.apache.tomcat:tomcat-tribes (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-311: Missing Encryption of Sensitive Data
Vulnerable versions: = 10.1.53
Patched in: 10.1.54

Summary: Apache Tomcat Missing Encryption of Sensitive Data vulnerability

Details:
Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor.

This issue affects Apache Tomcat: 11.0.20, 10.1.53, 9.0.116.

Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the issue.
GitHub Security Advisory: GHSA-69r9-qgr7-g2wj
Package: org.apache.tomcat:tomcat-tribes (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-311: Missing Encryption of Sensitive Data
Vulnerable versions: = 11.0.20
Patched in: 11.0.21

Summary: Apache Tomcat Missing Encryption of Sensitive Data vulnerability

Details:
Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor.

This issue affects Apache Tomcat: 11.0.20, 10.1.53, 9.0.116.

Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the issue.
GitHub Security Advisory: GHSA-h468-7pvh-8vr8
Package: org.apache.tomcat:tomcat (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-209: Generation of Error Message Containing Sensitive Information
Vulnerable versions: >= 7.0.100, <= 7.0.109
Patched in: unpatched

Summary: Apache Tomcat: Padding Oracle vulnerability in EncryptInterceptor

Details:
Padding Oracle vulnerability in Apache Tomcat's EncryptInterceptor with default configuration.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.0.0-M1 through 10.1.52, from 9.0.13 through 9..115, from 8.5.38 through 8.5.100, from 7.0.100 through 7.0.109.

Users are recommended to upgrade to version 11.0.19, 10.1.53 and 9.0.116, which fixes the issue.
GitHub Security Advisory: GHSA-h468-7pvh-8vr8
Package: org.apache.tomcat:tomcat-tribes (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-209: Generation of Error Message Containing Sensitive Information
Vulnerable versions: >= 7.0.100, <= 7.0.109
Patched in: unpatched

Summary: Apache Tomcat: Padding Oracle vulnerability in EncryptInterceptor

Details:
Padding Oracle vulnerability in Apache Tomcat's EncryptInterceptor with default configuration.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.0.0-M1 through 10.1.52, from 9.0.13 through 9..115, from 8.5.38 through 8.5.100, from 7.0.100 through 7.0.109.

Users are recommended to upgrade to version 11.0.19, 10.1.53 and 9.0.116, which fixes the issue.
GitHub Security Advisory: GHSA-h468-7pvh-8vr8
Package: org.apache.tomcat:tomcat (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-209: Generation of Error Message Containing Sensitive Information
Vulnerable versions: >= 8.5.38, <= 8.5.100
Patched in: unpatched

Summary: Apache Tomcat: Padding Oracle vulnerability in EncryptInterceptor

Details:
Padding Oracle vulnerability in Apache Tomcat's EncryptInterceptor with default configuration.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.0.0-M1 through 10.1.52, from 9.0.13 through 9..115, from 8.5.38 through 8.5.100, from 7.0.100 through 7.0.109.

Users are recommended to upgrade to version 11.0.19, 10.1.53 and 9.0.116, which fixes the issue.
GitHub Security Advisory: GHSA-h468-7pvh-8vr8
Package: org.apache.tomcat:tomcat-tribes (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-209: Generation of Error Message Containing Sensitive Information
Vulnerable versions: >= 8.5.38, <= 8.5.100
Patched in: unpatched

Summary: Apache Tomcat: Padding Oracle vulnerability in EncryptInterceptor

Details:
Padding Oracle vulnerability in Apache Tomcat's EncryptInterceptor with default configuration.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.0.0-M1 through 10.1.52, from 9.0.13 through 9..115, from 8.5.38 through 8.5.100, from 7.0.100 through 7.0.109.

Users are recommended to upgrade to version 11.0.19, 10.1.53 and 9.0.116, which fixes the issue.
GitHub Security Advisory: GHSA-h468-7pvh-8vr8
Package: org.apache.tomcat:tomcat (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-209: Generation of Error Message Containing Sensitive Information
Vulnerable versions: >= 11.0.0-M1, <= 11.0.18
Patched in: 11.0.20

Summary: Apache Tomcat: Padding Oracle vulnerability in EncryptInterceptor

Details:
Padding Oracle vulnerability in Apache Tomcat's EncryptInterceptor with default configuration.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.0.0-M1 through 10.1.52, from 9.0.13 through 9..115, from 8.5.38 through 8.5.100, from 7.0.100 through 7.0.109.

Users are recommended to upgrade to version 11.0.19, 10.1.53 and 9.0.116, which fixes the issue.
GitHub Security Advisory: GHSA-h468-7pvh-8vr8
Package: org.apache.tomcat:tomcat-tribes (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-209: Generation of Error Message Containing Sensitive Information
Vulnerable versions: >= 11.0.0-M1, <= 11.0.18
Patched in: 11.0.20

Summary: Apache Tomcat: Padding Oracle vulnerability in EncryptInterceptor

Details:
Padding Oracle vulnerability in Apache Tomcat's EncryptInterceptor with default configuration.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.0.0-M1 through 10.1.52, from 9.0.13 through 9..115, from 8.5.38 through 8.5.100, from 7.0.100 through 7.0.109.

Users are recommended to upgrade to version 11.0.19, 10.1.53 and 9.0.116, which fixes the issue.
GitHub Security Advisory: GHSA-h468-7pvh-8vr8
Package: org.apache.tomcat:tomcat-tribes (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-209: Generation of Error Message Containing Sensitive Information
Vulnerable versions: >= 10.1.50, < 10.1.53
Patched in: 10.1.53

Summary: Apache Tomcat: Padding Oracle vulnerability in EncryptInterceptor

Details:
Padding Oracle vulnerability in Apache Tomcat's EncryptInterceptor with default configuration.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.0.0-M1 through 10.1.52, from 9.0.13 through 9..115, from 8.5.38 through 8.5.100, from 7.0.100 through 7.0.109.

Users are recommended to upgrade to version 11.0.19, 10.1.53 and 9.0.116, which fixes the issue.
GitHub Security Advisory: GHSA-h468-7pvh-8vr8
Package: org.apache.tomcat:tomcat-tribes (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-209: Generation of Error Message Containing Sensitive Information
Vulnerable versions: >= 9.0.13, < 9.0.116
Patched in: 9.0.116

Summary: Apache Tomcat: Padding Oracle vulnerability in EncryptInterceptor

Details:
Padding Oracle vulnerability in Apache Tomcat's EncryptInterceptor with default configuration.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.0.0-M1 through 10.1.52, from 9.0.13 through 9..115, from 8.5.38 through 8.5.100, from 7.0.100 through 7.0.109.

Users are recommended to upgrade to version 11.0.19, 10.1.53 and 9.0.116, which fixes the issue.
GitHub Security Advisory: GHSA-xjw8-8c5c-9r79
Package: org.thymeleaf:thymeleaf-spring6 (MAVEN)
Severity: CRITICAL (CVSS 9.0)
CWE: CWE-917: Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection'), CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine
Vulnerable versions: <= 3.1.3.RELEASE
Patched in: 3.1.4.RELEASE

Summary: Improper neutralization of specific syntax patterns for unauthorized expressions in Thymeleaf

Details:
### Impact
A security bypass vulnerability exists in the expression execution mechanisms of Thymeleaf up to and including 3.1.3.RELEASE. Although the library provides mechanisms to prevent expression injection, it fails to properly neutralize specific syntax patterns that allow for the execution of unauthorized expressions. If an application developer passes unvalidated user input directly to the template engine, an unauthenticated remote attacker can bypass the library's protections to achieve Server-Side Template Injection (SSTI).

### Patches
This has been fixed in Thymeleaf 3.1.4.RELEASE.

### Workarounds
No workaround is available beyond ensuring applications do not pass unvalidated user input directly to the template engine. Upgrading to 3.1.4.RELEASE is strongly recommended in any case.

### Credits
Thanks to Dawid Bakaj (VIPentest.com) for responsible disclosure.
GitHub Security Advisory: GHSA-xjw8-8c5c-9r79
Package: org.thymeleaf:thymeleaf-spring5 (MAVEN)
Severity: CRITICAL (CVSS 9.0)
CWE: CWE-917: Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection'), CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine
Vulnerable versions: <= 3.1.3.RELEASE
Patched in: 3.1.4.RELEASE

Summary: Improper neutralization of specific syntax patterns for unauthorized expressions in Thymeleaf

Details:
### Impact
A security bypass vulnerability exists in the expression execution mechanisms of Thymeleaf up to and including 3.1.3.RELEASE. Although the library provides mechanisms to prevent expression injection, it fails to properly neutralize specific syntax patterns that allow for the execution of unauthorized expressions. If an application developer passes unvalidated user input directly to the template engine, an unauthenticated remote attacker can bypass the library's protections to achieve Server-Side Template Injection (SSTI).

### Patches
This has been fixed in Thymeleaf 3.1.4.RELEASE.

### Workarounds
No workaround is available beyond ensuring applications do not pass unvalidated user input directly to the template engine. Upgrading to 3.1.4.RELEASE is strongly recommended in any case.

### Credits
Thanks to Dawid Bakaj (VIPentest.com) for responsible disclosure.
GitHub Security Advisory: GHSA-xjw8-8c5c-9r79
Package: org.thymeleaf:thymeleaf (MAVEN)
Severity: CRITICAL (CVSS 9.0)
CWE: CWE-917: Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection'), CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine
Vulnerable versions: <= 3.1.3.RELEASE
Patched in: 3.1.4.RELEASE

Summary: Improper neutralization of specific syntax patterns for unauthorized expressions in Thymeleaf

Details:
### Impact
A security bypass vulnerability exists in the expression execution mechanisms of Thymeleaf up to and including 3.1.3.RELEASE. Although the library provides mechanisms to prevent expression injection, it fails to properly neutralize specific syntax patterns that allow for the execution of unauthorized expressions. If an application developer passes unvalidated user input directly to the template engine, an unauthenticated remote attacker can bypass the library's protections to achieve Server-Side Template Injection (SSTI).

### Patches
This has been fixed in Thymeleaf 3.1.4.RELEASE.

### Workarounds
No workaround is available beyond ensuring applications do not pass unvalidated user input directly to the template engine. Upgrading to 3.1.4.RELEASE is strongly recommended in any case.

### Credits
Thanks to Dawid Bakaj (VIPentest.com) for responsible disclosure.
GitHub Security Advisory: GHSA-r4v4-5mwr-2fwr
Package: org.thymeleaf:thymeleaf-spring6 (MAVEN)
Severity: CRITICAL (CVSS 9.0)
CWE: CWE-917: Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection'), CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine
Vulnerable versions: <= 3.1.3.RELEASE
Patched in: 3.1.4.RELEASE

Summary: Improper restriction of the scope of accessible objects in Thymeleaf expressions

Details:
### Impact
A security bypass vulnerability exists in the expression execution mechanisms of Thymeleaf up to and including 3.1.3.RELEASE. Although the library provides mechanisms to prevent expression injection, it fails to properly restrict the scope of accessible objects, allowing specific potentially sensitive objects to be reached from within a template. If an application developer passes unvalidated user input directly to the template engine, an unauthenticated remote attacker can bypass the library's protections to achieve Server-Side Template Injection (SSTI).

### Patches
This has been fixed in Thymeleaf 3.1.4.RELEASE.

### Workarounds
No workaround is available beyond ensuring applications do not pass unvalidated user input directly to the template engine. Upgrading to 3.1.4.RELEASE is strongly recommended in any case.


### Credits
Thanks to Thomas Reburn (Praetorian) for responsible disclosure.
GitHub Security Advisory: GHSA-r4v4-5mwr-2fwr
Package: org.thymeleaf:thymeleaf-spring5 (MAVEN)
Severity: CRITICAL (CVSS 9.0)
CWE: CWE-917: Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection'), CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine
Vulnerable versions: <= 3.1.3.RELEASE
Patched in: 3.1.4.RELEASE

Summary: Improper restriction of the scope of accessible objects in Thymeleaf expressions

Details:
### Impact
A security bypass vulnerability exists in the expression execution mechanisms of Thymeleaf up to and including 3.1.3.RELEASE. Although the library provides mechanisms to prevent expression injection, it fails to properly restrict the scope of accessible objects, allowing specific potentially sensitive objects to be reached from within a template. If an application developer passes unvalidated user input directly to the template engine, an unauthenticated remote attacker can bypass the library's protections to achieve Server-Side Template Injection (SSTI).

### Patches
This has been fixed in Thymeleaf 3.1.4.RELEASE.

### Workarounds
No workaround is available beyond ensuring applications do not pass unvalidated user input directly to the template engine. Upgrading to 3.1.4.RELEASE is strongly recommended in any case.


### Credits
Thanks to Thomas Reburn (Praetorian) for responsible disclosure.
GitHub Security Advisory: GHSA-r4v4-5mwr-2fwr
Package: org.thymeleaf:thymeleaf (MAVEN)
Severity: CRITICAL (CVSS 9.0)
CWE: CWE-917: Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection'), CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine
Vulnerable versions: <= 3.1.3.RELEASE
Patched in: 3.1.4.RELEASE

Summary: Improper restriction of the scope of accessible objects in Thymeleaf expressions

Details:
### Impact
A security bypass vulnerability exists in the expression execution mechanisms of Thymeleaf up to and including 3.1.3.RELEASE. Although the library provides mechanisms to prevent expression injection, it fails to properly restrict the scope of accessible objects, allowing specific potentially sensitive objects to be reached from within a template. If an application developer passes unvalidated user input directly to the template engine, an unauthenticated remote attacker can bypass the library's protections to achieve Server-Side Template Injection (SSTI).

### Patches
This has been fixed in Thymeleaf 3.1.4.RELEASE.

### Workarounds
No workaround is available beyond ensuring applications do not pass unvalidated user input directly to the template engine. Upgrading to 3.1.4.RELEASE is strongly recommended in any case.


### Credits
Thanks to Thomas Reburn (Praetorian) for responsible disclosure.
GitHub Security Advisory: GHSA-xmj9-7625-f634
Package: dev.dsf:dsf-bpe-server (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-670: Always-Incorrect Control Flow Implementation
Vulnerable versions: < 2.1.0
Patched in: unpatched

Summary: Data Sharing Framework has an Inverted Time Comparison in OIDC JWKS and Token Cache

Details:
### Affected Components
- DSF FHIR Server with enabled [bearer-token authentication](https://dsf.dev/operations/v2.1.0/fhir/oidc.html) or [back-channel logout](https://dsf.dev/operations/v2.1.0/fhir/oidc.html).
- DSF BPE Server with enabled [bearer-token authentication](https://dsf.dev/operations/v2.1.0/bpe/oidc.html) or [back-channel logout](https://dsf.dev/operations/v2.1.0/bpe/oidc.html).
- DSF BPE Server API v2 process plugins using [FHIR client connections](https://dsf.dev/operations/v2.1.0/bpe/fhir-client-connections.html) with configured OIDC authentication.

### Summary
- The OIDC JWKS and Metadata Document caches used an inverted time comparison (`isBefore` instead of `isAfter`), causing the cache to **never return cached values**. Every incoming request triggered a fresh HTTP fetch of the OIDC Metadata Document and JWKS keys from the OIDC provider.
- The OIDC token cache for the [FHIR client connections](https://dsf.dev/operations/v2.1.0/bpe/fhir-client-connections.html) used an inverted time comparison (`isBefore` instead of `isAfter`), causing the cache to **never invalidate**. Every incoming request returned the same OIDC token even if expired.

### Impact
- **Performance:** Every OIDC-authenticated request added network round-trips to the OIDC provider, increasing latency
- **Reliability:** Cached OIDC tokens become unusable after expiration and can only be invalidated by restart of the BPE. 
 If the OIDC provider is temporarily unreachable, all requests fail immediately instead of using cached keys
- **Load:** Unnecessary load on the OIDC provider, potentially causing rate limiting

### Fix (commits 31c2e974d, d3ca59b4d)
- Fixed cache timeout comparison from `isBefore` to `isAfter` in `BaseOidcClientWithCache` (configuration and JWKS caches) and `OidcClientWithCache` (configuration, JWKS, and access token caches)
- Added configurable cache timeouts via `dev.dsf.server.auth.oidc.provider.client.cache.timeout.configuration.resource` and `dev.dsf.server.auth.oidc.provider.client.cache.timeout.jwks.resource` (default: `PT1H`)
GitHub Security Advisory: GHSA-xmj9-7625-f634
Package: dev.dsf:dsf-bpe-process-api-v2 (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-670: Always-Incorrect Control Flow Implementation
Vulnerable versions: < 2.1.0
Patched in: unpatched

Summary: Data Sharing Framework has an Inverted Time Comparison in OIDC JWKS and Token Cache

Details:
### Affected Components
- DSF FHIR Server with enabled [bearer-token authentication](https://dsf.dev/operations/v2.1.0/fhir/oidc.html) or [back-channel logout](https://dsf.dev/operations/v2.1.0/fhir/oidc.html).
- DSF BPE Server with enabled [bearer-token authentication](https://dsf.dev/operations/v2.1.0/bpe/oidc.html) or [back-channel logout](https://dsf.dev/operations/v2.1.0/bpe/oidc.html).
- DSF BPE Server API v2 process plugins using [FHIR client connections](https://dsf.dev/operations/v2.1.0/bpe/fhir-client-connections.html) with configured OIDC authentication.

### Summary
- The OIDC JWKS and Metadata Document caches used an inverted time comparison (`isBefore` instead of `isAfter`), causing the cache to **never return cached values**. Every incoming request triggered a fresh HTTP fetch of the OIDC Metadata Document and JWKS keys from the OIDC provider.
- The OIDC token cache for the [FHIR client connections](https://dsf.dev/operations/v2.1.0/bpe/fhir-client-connections.html) used an inverted time comparison (`isBefore` instead of `isAfter`), causing the cache to **never invalidate**. Every incoming request returned the same OIDC token even if expired.

### Impact
- **Performance:** Every OIDC-authenticated request added network round-trips to the OIDC provider, increasing latency
- **Reliability:** Cached OIDC tokens become unusable after expiration and can only be invalidated by restart of the BPE. 
 If the OIDC provider is temporarily unreachable, all requests fail immediately instead of using cached keys
- **Load:** Unnecessary load on the OIDC provider, potentially causing rate limiting

### Fix (commits 31c2e974d, d3ca59b4d)
- Fixed cache timeout comparison from `isBefore` to `isAfter` in `BaseOidcClientWithCache` (configuration and JWKS caches) and `OidcClientWithCache` (configuration, JWKS, and access token caches)
- Added configurable cache timeouts via `dev.dsf.server.auth.oidc.provider.client.cache.timeout.configuration.resource` and `dev.dsf.server.auth.oidc.provider.client.cache.timeout.jwks.resource` (default: `PT1H`)
GitHub Security Advisory: GHSA-gj7p-595x-qwf5
Package: dev.dsf:dsf-bpe-server (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-613: Insufficient Session Expiration
Vulnerable versions: < 2.1.0
Patched in: unpatched

Summary: Data Sharing Framework is Missing Session Timeout for OIDC Sessions

Details:
### Affected Components
DSF FHIR Server with enabled [OIDC authentication](https://dsf.dev/operations/v2.1.0/fhir/oidc.html).
DSF BPE Server with enabled [OIDC authentication](https://dsf.dev/operations/v2.1.0/bpe/oidc.html).

### Summary
OIDC-authenticated sessions had no configured maximum inactivity timeout. Sessions persisted indefinitely after login, even after the OIDC access token expired.

### Impact
If a user logs in via OIDC and leaves their browser without explicitly logging out, the session remains valid indefinitely. Another person using the same browser can access the DSF UI with the previous user's permissions. This is a realistic threat in hospital environments with shared workstations.

Only affects OIDC browser sessions, not relevant for mTLS machine-to-machine communication.

### Fix (commits f4ecb00, 7d25fea)
- Added configurable session timeout via `dev.dsf.server.auth.oidc.session.timeout` (default: `PT30M`).
- Enabled `logoutWhenIdTokenIsExpired(true)` in OpenID configuration to tie session lifetime to token lifetime.
- Websocket sessions are now closed with `VIOLATED_POLICY` when credentials expire, prevents stale websocket connections from continuing to receive events after session timeout.