taiga: MOAD-0003 threadlocal session_id; redmine-0004: add_permission! O(P^2); MOADs 0001/0002/0004/0005 CLEAN

taiga-0001: taiga/events/middleware.py stores request X-Session-ID in threading.local,
leaking it across thread-pool requests when process_response is skipped.
Fix: replace with contextvars.ContextVar for proper per-request isolation.

redmine-0004: Role#add_permission! in app/models/role.rb calls permissions.include?(p)
(Array O(P)) inside a perms.each loop — O(P^2) total. At P=1000 permissions,
68.6x overhead measured. Fix: build a Set once before the loop, use Set#add?.

defects/taiga/patch/CLEAN-MOAD-0001.txt

@@ -0,0 +1,4 @@
+MOAD-0001 (CWE-407): CLEAN
+Taiga-back uses set() and dict() for membership checks throughout.
+apply_order_updates uses a set for updated_order_ids; calculate_permissions
+returns set(). No list.contains() inside loops found in hot paths.

defects/taiga/patch/CLEAN-MOAD-0002.txt

@@ -0,0 +1,3 @@
+MOAD-0002 (Intertangle): CLEAN
+No shared mutable god object found. Settings are read-only Django conf.
+Subsystems communicate through well-defined service interfaces.

defects/taiga/patch/CLEAN-MOAD-0004.txt

@@ -0,0 +1,3 @@
+MOAD-0004 (CWE-312): CLEAN
+No passwords, tokens, or LDAP credentials logged verbatim in error paths.
+Auth logging limited to error messages without credential values.

defects/taiga/patch/CLEAN-MOAD-0005.txt

@@ -0,0 +1,4 @@
+MOAD-0005 (Thundering Herd): CLEAN
+Django cache usage in throttling follows standard DRF pattern.
+Throttle history race is acceptable for rate-limiting use case (idempotent).
+Markdown render cache is also acceptable (idempotent compute).