Wilder Birch Backport 26.4

🛠️ Bug Fixes & Stability Patches Discovery Endpoint Clutter: Added features allowing admins to intentionally hide client scopes from scopes_supported configurations. Rate Limiting Buffers: Integrated an email verification rate limiter to block credential/email update flooding. User Profile Attribute Saving: Fixed a UI regression that triggered errors whenever modifying specific user profile attribute groupings. Client Deletion Scale: Optimized database cleanup loops so that dropping a client with massive active sessions no longer triggers timeouts. Quarkus Host Binding: Resolved a regression regarding DEBUG_PORT handling to ensure custom host/port combinations bond properly. [1, 2]

⚠️ Deprecations & Breaking Behavioral Changes Non-Normalized Paths: The http-accept-non-normalized-paths option is deprecated and prepared for complete removal due to filter bypass exploits. Stricter Audience Validations: Token endpoints now strictly enforce OIDC Core compliance, mandating that the audience value must resolve strictly as a string issuer. Proxy Address Changes: Omitting target ports in the Host headers will no longer default resolve to arbitrary port arrays like :8080. [1, 2]