Improper Handling of Alternate Encoding

Summary

The `DigestAuthentication.apply()` method in Jetty's HTTP client uses `getBytes(StandardCharsets.ISO_8859_1)` at three locations (lines 171, 179, 196) to compute Digest auth response hashes. ISO-8859-1 silently replaces any character above U+00FF (Chinese, Japanese, Cyrillic, Arabic, Emoji, etc.) with 0x3F (`?`), causing all such characters to produce identical hash contributions. An attacker who knows a victim's username can bypass Digest authentication by replacing all non-Latin-1 characters in the password with `?` characters, since the collision password produces the same MD5-based Digest response hash as the original password. The packages: "org.eclipse.jetty.ee8:jetty-ee8-security" and "org.eclipse.jetty.ee9:jetty-ee9-security" are affected from 12.0.0 prior to 12.0.36 and 12.1.0 prior to 12.1.10. The package "org.eclipse.jetty:jetty-security" is affected from versions 9.4.0.v20161208 prior to 9.4.63, 10.0.0 prior to 10.0.31, 11.0.0 prior to 11.0.31, 12.0.0 prior to 12.0.36 and 12.1.0 prior to 12.1.10.