radius: verify the request Message-Authenticator

[KernelClint]

Radius_am answers RADIUS Access-Requests. A request may carry attribute 80,
Message-Authenticator: an HMAC-MD5 over the request computed with the shared secret, with the
attribute's own value zeroed for the computation. It is what proves the request came from a client
holding the secret.

scapy/layers/radius.py:1589-1606
collects the request's attributes into a map and moves straight on to building the response, without
ever checking that value. A request with a correct Message-Authenticator and one with a single bit
flipped in it are both answered with Access-Accept.

The change recomputes the value and compares before anything else happens:

+        # Verify the request Message-Authenticator, if present
+        if 80 in attrs:
+            ...
+            expected = hmac.new(
+                self.secret,
+                struct.pack("!BBH", radius.code, radius.id, length)
+                + radius.authenticator
+                + attributes,
+                hashlib.md5,
+            ).digest()
+            if not hmac.compare_digest(received, expected):
+                return

The comparison is constant-time, and the check runs before any authentication or response
construction. Requests without attribute 80 are unaffected, as are valid ones.

The added regression sends a valid PAP request, asserts Access-Accept, then flips one bit in the
Message-Authenticator and asserts no response. Without the source change it fails.

Performance was measured on one computer, before and after the fix: an exchange took 170.9 µs
before and 182.6 µs after — 11.7 µs slower, or 6.8%. Repeat runs moved by about 5%, so this one
is larger than the test's own variation and is a real cost rather than noise.

It is worth stating plainly: that cost is one HMAC-MD5 over the request, which is the work the check
requires, and it is only paid when the attribute is present.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 80.64%. Comparing base (b3bbcc8) to head (546a56e).

Additional details and impacted files

@@           Coverage Diff           @@
##           master    #5138   +/-   ##
=======================================
  Coverage   80.63%   80.64%           
=======================================
  Files         390      390           
  Lines       96936    96946   +10     
=======================================
+ Hits        78168    78183   +15     
+ Misses      18768    18763    -5     

Files with missing lines	Coverage Δ
scapy/layers/radius.py	92.57% <100.00%> (+0.17%)	⬆️

... and 5 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.