GHSA-x677-9fxg-v5c5: Traefik: Incomplete fix for CVE-2026-33433 + CVE-2026-39858 cross-cohort: headerField underscore-variant identity spoofing in BasicAuth / DigestAuth / ForwardAuth

Traefik has a vulnerability in its authentication middlewares (BasicAuth, DigestAuth, and ForwardAuth) where attackers can spoof user identity by using header names with underscores instead of dashes. For example, an attacker could send `X_Auth_User` instead of `X-Auth-User`, and because many backends treat underscores and dashes the same way, the spoofed header reaches the backend alongside the legitimate authentication value, allowing the attacker to impersonate a user.