Username enumeration via invalid placeholder bcrypt hash

Timing side channel in HashiCorp Vault and Vault Enterprise allows remote attackers to enumerate valid userpass usernames through response timing. For nonexistent names, the userpass path passes an invalid placeholder hash to CompareHashAndPassword, which exits before normal bcrypt work. No credentials or user interaction are required, but repeated network measurements are needed; the consequence is disclosure of which userpass accounts exist.