... to avoid problems caused by the latest libraries.

Change-Id: Ibfccb2aca12a5f25e5179143f95dac63bde1e5e1
(cherry picked from commit 21782d3)

Change-Id: I8bf1cfd098bb655e3f935b81f3aebb0254d5dd06

Update the URL to the upper-constraints file to point to the redirect
rule on releases.openstack.org so that anyone working on this branch
will switch to the correct upper-constraints list automatically when
the requirements repository branches.

Until the requirements repository has as stable/2025.1 branch, tests will
continue to use the upper-constraints list on master.

Change-Id: Iabc57faf7430f2e31c30ac63ad548e2aa42757b0

The external_oauth2_token middleware did not sanitize incoming
authentication headers before processing OAuth 2.0 tokens. This
allowed an attacker to send forged identity headers (e.g.,
X-Is-Admin-Project, X-Roles, X-User-Id) that would not be cleared
by the middleware, potentially enabling privilege escalation.

This fix adds a call to remove_auth_headers() at the start of
request processing to sanitize all incoming identity headers,
matching the secure behavior of the main auth_token middleware.

Closes-Bug: #2129018
Change-Id: Idd4fe1d17a25b3064b31f454d9830242f345e018
(cherry picked from commit b473c0ed1467b70c74c8a82cb4d15ccf8424b27b)
Signed-off-by: Jeremy Stanley <fungi@yuggoth.org>
Signed-off-by: Artem Goncharov <artem.goncharov@gmail.com>