Cache HIBP prefix responses

[dknauss]

Description of the Change

Improves the Have I Been Pwned password check by caching the k-anonymity prefix response and setting an explicit request timeout.

Previously the result was cached per full password hash, which avoids repeat checks for the same password but does not reuse the HIBP range response for different passwords sharing the same prefix. This change caches the prefix response in object cache and a transient, then checks the local suffix list for the submitted password hash.

The HTTP request now also has a short default timeout, filterable with tenup_experience_hibp_request_timeout.

Benefits

• Reduces repeated outbound HIBP requests for the same SHA-1 prefix.
• Avoids caching full-hash pass/fail results.
• Prevents password-validation requests from waiting on the WordPress HTTP API default timeout.
• Keeps the existing k-anonymity request model.

Possible Drawbacks

The prefix response may be reused for up to four hours. This is appropriate for reducing repeated external calls, but it means newly-added HIBP entries for an already-cached prefix may not be seen until the cache expires.

Verification Process

• php -l includes/classes/Authentication/Passwords.php
• composer run lint
• git diff --check

Changelog Entry

Fixed - Cache Have I Been Pwned prefix responses and add a request timeout.

Checklist:

• My code follows the code style of this project.
• All new and existing tests pass. (No automated test suite exists in this repo; CI runs lint only.)

A note on tests

This change has unit-testable logic, but the plugin currently ships no test harness (no PHPUnit or e2e setup; CI runs lint only), so there's nothing here to add coverage to. I'm happy to contribute a minimal test setup plus coverage for this in a separate PR if that's welcome.

AI assistance was used in drafting and reviewing this change; final authorship and verification are mine.