Password disclosure via asynchronous log mutation race

Race condition in Vdsm before 4.50.0.4 allows local users to read passwords from logs during asynchronous logging. The unprotect_passwords function modifies a caller-supplied object in place, so an asynchronous logger can serialize it after protected values have been replaced with plaintext. Exploitation requires low-privilege local access, precise timing, and access to a log containing an object that is concurrently unprotected.