Merge commit from fork

docs/testing/security-regressions.md requires every fixed advisory to map to a
named, greppable regression test. Rename the tests added with the fixes to carry
their advisory id so `rg -i ghsa` finds them, and add the four rows to the
advisory -> test map.

Adds the FTPS MKD regression test that was missing. It primes the dummy backend
with a successful create_bucket, so the assertion distinguishes "denied at the
authorization boundary" from "backend refused" — without the queued success an
unconfigured create_bucket fails on its own and the test would pass even with
the authorization check removed. Verified it fails when the check is reverted.

DummyBackend gains a Debug impl (FtpsDriver's trait bounds require it) and a
queue_create_bucket_ok helper.

Records in the CI-execution map why ghsa_g3vq_* runs in the default pass despite
sitting behind the ftps feature: the rustfs crate defaults to ["ftps", "webdav"]
and cargo unifies features across the workspace build, so the test executes
there even though `cargo test -p rustfs-protocols` alone would skip it.

rustfs/src/auth.rs

@@ -1345,7 +1345,7 @@ mod tests {
     }
 
     #[test]
-    fn test_identity_condition_keys_ignore_spoofed_headers() {
+    fn ghsa_6r96_identity_condition_keys_ignore_spoofed_headers() {
         let cred = create_test_credentials();
         let mut headers = HeaderMap::new();
         // A caller naming its headers after identity condition keys must not be able
@@ -1369,7 +1369,7 @@ mod tests {
     }
 
     #[test]
-    fn test_claim_condition_keys_ignore_spoofed_headers() {
+    fn ghsa_6r96_claim_condition_keys_ignore_spoofed_headers() {
         // The credential carries no groups/roles claims, so these keys are absent --
         // precisely the case a spoofed header would otherwise fill in.
         let cred = create_test_credentials();