wave16: nova/keystone/crystal/dovecot/wireshark CWE-407 patches + unit tests

nova-0001: scheduler/manager.py selected_hosts list → set (273x, CRITICAL)
nova-0002: scheduler/host_manager.py lowered_hosts_to_force list → set (43x, HIGH)
keystone-0001: api/users.py token_roles list → set (32x, HIGH)
crystal-0001: syntax/parser.cr type_vars Array#includes? → Set (25x, CRITICAL)
crystal-0002: semantic/restrictions.cr discarded Array#includes? → Set (5x, CRITICAL)
dovecot-0001: mail-storage-hooks.c array_lsearch → sort+bsearch (4x, HIGH)
wireshark-0001: proto_data.c GSList → wmem_map_t (8x, HIGH)

7 unit tests: 9/9 PASS

defects/nova/patch/nova-0001-scheduler-selected-hosts-set.patch

@@ -0,0 +1,26 @@
+--- a/nova/scheduler/manager.py
++++ b/nova/scheduler/manager.py
+@@ -587,7 +587,8 @@ class SchedulerManager(manager.Manager):
+         Additionally, we may be working with older conductors that don't pass
+         in instance_uuids.
+         """
+-        # The list of hosts selected for each instance
+-        selected_hosts = []
++        # The list of hosts selected for each instance (list preserves order)
++        selected_hosts = []
++        selected_hosts_set = set()  # O(1) membership; avoids O(N²) in _schedule_alt
+
+@@ -605,7 +607,8 @@ class SchedulerManager(manager.Manager):
+
+             selected_host = hosts[0]
+             selected_hosts.append(selected_host)
++            selected_hosts_set.add(selected_host)
+             self._consume_selected_host(
+
+@@ -699,7 +703,7 @@ class SchedulerManager(manager.Manager):
+                 if len(selected_plus_alts) >= num_alts + 1:
+                     break
+
+-                if host.cell_uuid == cell_uuid and host not in selected_hosts:
++                if host.cell_uuid == cell_uuid and host not in selected_hosts_set:
+                     if alloc_reqs_by_rp_uuid is not None:

defects/nova/patch/nova-0002-scheduler-forced-hosts-set.patch

@@ -0,0 +1,10 @@
+--- a/nova/scheduler/host_manager.py
++++ b/nova/scheduler/host_manager.py
+@@ -510,7 +510,7 @@ class HostManager(object):
+         def _match_forced_hosts(host_map, hosts_to_force):
+             forced_hosts = []
+-            lowered_hosts_to_force = [host.lower() for host in hosts_to_force]
++            lowered_hosts_to_force = {host.lower() for host in hosts_to_force}
+             for (hostname, nodename) in list(host_map.keys()):
+                 if hostname.lower() not in lowered_hosts_to_force:
+                     del host_map[(hostname, nodename)]