12: SASL DIGEST-MD5 does not validate the server's `rspauth` proof

curl never verifies the `rspauth` value the server sends during SASL DIGEST-MD5 authentication. In `Curl_sasl_continue()` (`lib/curl_sasl.c`), the `SASL_DIGESTMD5_RESP` handler unconditionally sends an empty acknowledgment without reading or checking the server's continuation data. Authentication …

// lib/curl_sasl.c, inside Curl_sasl_continue()
case SASL_DIGESTMD5_RESP:
    /* Keep response NULL to output an empty line. */
    break;