clementine: 2 CWE-407 defects; mpd + rhythmbox CLEAN

clementine-0001: LibraryWatcher ScanSubdirectory FindSongByPath O(F*S) +
files_on_disk.contains O(S*F) — linear scan with TODO comment, fix with
HashMap + HashSet. HIGH severity, 250x at N=1000.

clementine-0002: SongSender indexOf(s) O(N^2) in SendAlbum/SendPlaylist/
SendUrls loops — fix with integer counter + QSet for requested_ids.
MEDIUM severity, 500x at N=1000.

MPD: CLEAN — uses std::set, bitmask arrays, std::map throughout.
Rhythmbox: CLEAN — uses g_hash_table for all membership checks.

4/4 unit tests PASS.

defects/rhythmbox/patch/CLEAN.md

@@ -0,0 +1,24 @@
+# Rhythmbox - CWE-407 Scan Result: CLEAN
+
+Scanned: 2026-03-30
+Source: https://github.com/GNOME/rhythmbox (depth=1)
+
+## Scan Summary
+
+Rhythmbox uses GLib hash tables throughout for membership testing:
+
+- **Database entries**: `g_hash_table` for entry storage and lookup
+- **Property model**: `g_hash_table` (reverse_map) + `g_sequence` (balanced tree) for properties
+- **Keyword tracking**: `g_hash_table` for keyword-to-entry mapping
+- **Playlist membership**: `g_hash_table` via `rb_playlist_source_location_in_map`
+- **Changed entries**: `g_hash_table` for tracking changes
+- **Import dedup**: `g_hash_table` for added/deleted entry tracking
+
+The `rb_string_list_contains` calls (linear GList scan) are used only for
+mount-point lists which are bounded to a handful of entries (typically 2-5
+filesystem mount points).
+
+The `g_list_find` calls in display-page-model operate on DnD target atom
+lists (bounded by GTK target types, ~10 max).
+
+No CWE-407 defects found.