jitsi-videobridge: 3 CWE-407 defects, MOADs 0002-0005 CLEAN; woodpecker: 1 CWE-407 + 1 CWE-312, MOADs 0002/0003/0005 CLEAN

jitsi-videobridge (Kotlin/Java video conferencing bridge):
- 0001: Prioritize.kt selectedSourceNames.contains()+indexOf() inside forEach over conferenceSources, O(C*S)
- 0002: BandwidthAllocator.kt selectedSources getter List.contains() dedup inside forEach, O(S^2)
- 0003: ConferenceSpeechActivity.java endpointsChanged() ArrayList.contains() in removeIf+for loop, O(E^2)
  Fix: HashSet for O(1) membership; pre-built index map for indexOf
  Unit test: 4/4 PASS, 19-35x op-count reduction at N=200

woodpecker-0001 (Go CI/CD pipeline step builder):
- filterItemsWithMissingDependencies() calls containsItemWithName() (O(N) linear scan) inside
  two nested loops over items and deps: O(N*D*N) = O(N^2)
  Fix: pre-build name-set map for O(1) lookup, O(N) total
  Unit test: 3/3 PASS, 20x op-count reduction at N=100

woodpecker-0002 (CWE-312 credential logging):
- shared/token/token.go ParseRequest() logs raw Authorization header value at Trace level:
  log.Trace().Msgf("token.ParseRequest: found token in header: %s", token)
  Exposes full Bearer JWT token in application logs
  Fix: log only that header was found, not its value
  Unit test: 3/3 PASS

defects/woodpecker-0002/patch/0001-token-parserequest-cwe312-fix.patch

@@ -0,0 +1,15 @@
+diff --git a/shared/token/token.go b/shared/token/token.go
+index abcdef0..1234567 100644
+--- a/shared/token/token.go
++++ b/shared/token/token.go
+@@ -68,8 +68,8 @@ func ParseRequest(allowedTypes []Type, r *http.Request, fn SecretFunc) (*Token,
+ 	// first we attempt to get the token from the
+ 	// authorization header.
+ 	token := r.Header.Get("Authorization")
+ 	if len(token) != 0 {
+-		log.Trace().Msgf("token.ParseRequest: found token in header: %s", token)
++		// CWE-312 fix: do NOT log the Authorization header value — it contains the raw Bearer token.
++		log.Trace().Msg("token.ParseRequest: found token in Authorization header")
+ 		bearer := token
+ 		if _, err := fmt.Sscanf(token, "Bearer %s", &bearer); err != nil {
+ 			return nil, err