[CODEC-245] Reject malformed Sha2Crypt salt syntax

[efegokdemir]

Description

Sha2Crypt accepted malformed salt strings such as $5$notrounds=1000$asdfasdf and salts containing characters outside the documented alphabet by matching a valid prefix and ignoring the remaining input. The validation pattern is now anchored to the complete salt structure while preserving the existing support for an optional hash suffix and salt truncation.

Link to tracking issue

https://issues.apache.org/jira/browse/CODEC-245

Testing

• mvn -Dtest=Sha512CryptTest test
• mvn test
• mvn -DskipTests verify
• git diff --check

All commands completed successfully. The pre-fix regression run failed because the malformed inputs were accepted; the focused test passes with this change.

Documentation

No documentation changes are required. Existing valid salts, including salts followed by a hash suffix and salts longer than 16 characters, remain covered by the existing tests.

AI disclosure

• I used AI to create part of this pull request. Codex assisted with issue investigation, implementation, test authoring, and validation; I reviewed the resulting changes and test output.

The open CODEC-182 PR #301 concerns separate Javadoc/prefix validation changes and does not implement the malformed-rounds or invalid-character rejection tracked by CODEC-245.