r2dbc-mariadb Parsec auth: server-controlled PBKDF2 iteration count causes CPU-exhaustion DoS ( regression from b7766de )

In mariadb-connector-r2dbc 1.4.1 (HEAD a82d265, all released versions), the Parsec authentication plugin derives its key with PBKDF2 using an iteration count of `1024 << iterations`, where `iterations` is a single byte read directly from the server's ext-salt response and bounded only by the check …

 64   if (buf.readableBytes() > 2) {
 65     firstByte = buf.readByte();
 66     iterations = buf.readByte();          // fully server-controlled
 67   }
 68
 69   if (firstByte != 0x50 || iterations > 20) {   // only upper bound
 70     throw new R2dbcNonTransientResourceException(...);
 71   } …