bzflag: 3 CWE-407 defects, MOAD 0002-0005 CLEAN

bzflag-0001: bz_EventHandler::HasEvent() std::find on HandledEvents vector
  called per-handler per-event-fire in callEvents hot path. O(E*H).
  Fix: std::bitset<bz_eLastEvent>. HIGH, 8.4x speedup.

bzflag-0002: AccessControlList ban/hostBan/idBan std::find on growing
  ban vector for dedup. O(B^2) during merge() of master ban list.
  Fix: parallel unordered_set index. MEDIUM, 17x speedup.

bzflag-0003: parsePermissionString customPerms std::find dedup O(W*C).
  Fix: std::set shadow for dedup. LOW-MEDIUM, 5.1x speedup.

MOAD-0004: bzfs.cxx:4732 logs auth token verbatim at debug level 1
  (logDebugMessage with player token). Noted, not patched (debug only).

MOAD-0002 (intertangle): global mutable state typical for 1993 C++ game
  server, not a clean god-object coupling defect.
MOAD-0003 (leaked context): no thread_local usage found. CLEAN.
MOAD-0005 (thundering herd): single-threaded server, no cache races. CLEAN.

defects/bzflag-0001/patch/bzflag-0001.patch

@@ -0,0 +1,60 @@
+--- a/include/WorldEventManager.h
++++ b/include/WorldEventManager.h
+@@ -24,8 +24,8 @@
+ #include "common.h"
+
+ // System headers
++#include <bitset>
+ #include <map>
+-#include <vector>
+ #include <algorithm>
+
+ // Common headers
+@@ -48,22 +48,27 @@
+             plugin->Event(eventData);
+     }
+
+-    std::vector<bz_eEventType> HandledEvents;
++    std::bitset<bz_eLastEvent> handledEventBits;
+
+     bool HasEvent( bz_eEventType evt)
+     {
+-        return std::find(HandledEvents.begin(),HandledEvents.end(),evt) != HandledEvents.end();
++        return (evt >= 0 && evt < bz_eLastEvent) && handledEventBits.test(evt);
+     }
+
+     void AddEvent( bz_eEventType evt )
+     {
+-        if (std::find(HandledEvents.begin(),HandledEvents.end(),evt) == HandledEvents.end())
+-            HandledEvents.push_back(evt);
++        if (evt >= 0 && evt < bz_eLastEvent)
++            handledEventBits.set(evt);
+     }
+
+     void RemoveEvent( bz_eEventType evt )
+     {
+-        std::vector<bz_eEventType>::iterator itr = std::find(HandledEvents.begin(),HandledEvents.end(),evt);
+-
+-        if ( itr!= HandledEvents.end())
+-            HandledEvents.erase(itr);
++        if (evt >= 0 && evt < bz_eLastEvent)
++            handledEventBits.reset(evt);
++    }
++
++    bool HasNoEvents() const
++    {
++        return handledEventBits.none();
+     }
+ };
+
+--- a/src/bzfs/WorldEventManager.cxx
++++ b/src/bzfs/WorldEventManager.cxx
+@@ -147,7 +147,7 @@
+     bz_EventHandler *handler = HandlerMap[plugin];
+     worldEventManager.removeEvent(eventType,handler);
+
+-    if (handler->HandledEvents.empty())
++    if (handler->HasNoEvents())
+         worldEventManager.removeHandler(handler);
+
+     return true;