Authentication bypass via trailing-slash endpoint alias

Authentication bypass in affected Apache Tomcat releases allows remote attackers to evade security constraints on WebSocket endpoints. The WebSocket URI-template matcher treated a protected endpoint path with and without a trailing slash as the same endpoint, while servlet security-constraint matching treated them as different resource names. A deployment is exposed only when a WebSocket endpoint is protected by a path-specific security constraint; an unauthenticated request using the alternate trailing-slash form can reach that endpoint.