Unauthenticated user enumeration via unequal login work

Observable timing discrepancy in OpenBao 0.1.0 through 2.3.1 allows remote attackers to enumerate userpass accounts. The userpass login path uses a raw dummy byte string for nonexistent users instead of a valid bcrypt hash and can avoid the storage work performed for existing users, producing measurable response-time differences. The userpass method must be enabled and reachable; no valid credentials are required, but repeated probes can trigger the default user-lockout control for real accounts.