wave16: nova/keystone/crystal/dovecot/wireshark CWE-407 patches + unit tests

nova-0001: scheduler/manager.py selected_hosts list → set (273x, CRITICAL)
nova-0002: scheduler/host_manager.py lowered_hosts_to_force list → set (43x, HIGH)
keystone-0001: api/users.py token_roles list → set (32x, HIGH)
crystal-0001: syntax/parser.cr type_vars Array#includes? → Set (25x, CRITICAL)
crystal-0002: semantic/restrictions.cr discarded Array#includes? → Set (5x, CRITICAL)
dovecot-0001: mail-storage-hooks.c array_lsearch → sort+bsearch (4x, HIGH)
wireshark-0001: proto_data.c GSList → wmem_map_t (8x, HIGH)

7 unit tests: 9/9 PASS

defects/crystal/patch/crystal-0001-parser-type-vars-set.patch

@@ -0,0 +1,20 @@
+--- a/src/compiler/crystal/syntax/parser.cr
++++ b/src/compiler/crystal/syntax/parser.cr
+@@ -1747,6 +1747,7 @@ module Crystal
+       splat_index = nil
+       if @token.type.op_lparen?
+         type_vars = [] of String
++        type_vars_seen = Set(String).new  # O(1) duplicate check; avoids O(N²) over param list
+
+         next_token_skip_space_or_newline
+
+@@ -1760,7 +1761,8 @@ module Crystal
+           type_var_name = check_const
+
+-          if type_vars.includes? type_var_name
++          if type_vars_seen.includes? type_var_name
+             raise "duplicated type parameter name: #{type_var_name}", @token
+           end
+
+           type_vars.push type_var_name
++          type_vars_seen.add type_var_name

defects/crystal/patch/crystal-0002-restrictions-discarded-set.patch

@@ -0,0 +1,19 @@
+--- a/src/compiler/crystal/semantic/restrictions.cr
++++ b/src/compiler/crystal/semantic/restrictions.cr
+@@ -1051,7 +1051,7 @@ module Crystal
+
+       types = [] of Type
+-      discarded = [] of Type
++      discarded = Set(Type).new  # O(1) membership; avoids O(T×O) in union restriction loop
+       other_types.each do |other_type|
+         self.union_types.each do |type|
+           next if discarded.includes?(type)
+
+           restricted = type.restrict(other_type, context)
+           if restricted
+             types << restricted
+-            discarded << type
++            discarded.add type
+           end
+         end
+       end