basic auth blanks literal braces in usernames and passwords (unknown placeholders)

Which area

caddyauth (basic auth)

What happened

the basic auth provider expands account usernames and passwords with repl.ReplaceAll, which blanks any {...} the replacer does not recognize

a config like

basic_auth {
	alice-{bogus} <bcrypt hash>
}

provisions the account as alice- (unknown braces swallowed), and a password value with braces like ab{cd}ef is quietly rewritten to abef, which still parses as valid base64 but is not a usable bcrypt hash, so the config mistake passes provisioning silently and logins just fail instead of the config erroring

respond headers were switched to repl.ReplaceKnown in #8014 and the header handler in #4880 (same class as #4418), so basic auth credentials look like the remaining config-data site still on ReplaceAll

Repro (1 command, go test on master 56e3a88e)

go test ./modules/caddyhttp/caddyauth/ -run TestBasicAuth -count=1

raw output on untouched master:

--- FAIL: TestBasicAuthProvisionKeepsUnknownPlaceholdersInUsername (0.00s)
    basicauth_test.go:43: expected an account for the username as configured, got accounts ["alice-"]
--- FAIL: TestBasicAuthProvisionRejectsBracedPasswordInsteadOfRewritingIt (0.00s)
    basicauth_test.go:98: expected provisioning to fail for a password with literal braces, instead it accepted the rewritten password "i\xb7\x9f"
FAIL

expected: unknown {...} in credentials survive as literal config data, real placeholders like {env.*} still expand

Version

master 56e3a88e (post v2.10.2)

Assistance disclosure

AI used: yes, for drafting the test and formatting this report