Authenticated service interrupt via auth_context recursion

Denial of service in Wazuh manager before 4.14.7 and 5.0.0-beta2 allows remote authenticated users to stall API authentication. The POST /security/user/authenticate/run_as path recursively walks attacker-supplied auth_context JSON, applies role-defined regular expressions without a timeout, and runs that work through a single-worker authentication pool. Exploitation requires credentials with allow_run_as enabled; repeated deeply nested or oversized requests can monopolize authentication handling and deny service to other API consumers without published evidence of data read or modification.