[dklawren]

Review carried over from private pull request
https://bugzilla.mozilla.org/show_bug.cgi?id=2084154

[Copilot]

🟢 Approval recommended

No active review issues are reported for the hash-token validation hardening.

No open issues 🎉

What changed in this PR

Hardens Bugzilla’s hash-token validation against field-shifting forgeries by validating timestamps before regenerating tokens and sharing token-format parsing with CGI login.

Changes:

• Requires ASCII numeric timestamps and adds a shared hash_token_time parser.
• Adds regression tests for forged tokens, malformed input, and valid token round-trips.
• Removes a leftover patch-reject file.

File	Description
t/​hash-token.t	Adds hash-token validation and forgery regression tests.
Bugzilla/​Token.pm	Validates issuance timestamps and centralizes token-format parsing.
Bugzilla/​Auth/​Login/​CGI.pm	Uses the shared parser before regenerating login tokens.
Bugzilla/​API/​V1/​Github.pm.rej	Deletes a leftover patch-reject artifact.

_{Review effort: Balanced}