caddyauth: only replace known placeholders in basic auth credentials - #8017

Fixes #8016

Summary

the basic auth provider expanded account usernames and passwords with repl.ReplaceAll, which blanks any {...} the replacer does not recognize, so a username like alice-{bogus} was provisioned as alice- and a password like ab{cd}ef was quietly rewritten into different valid base64

this switches both to repl.ReplaceKnown, matching the respond headers fix in #8014 and the header handler fix in #4880 (same class as #4418), so unrecognized braces in credentials are left intact and real placeholders like {env.*} still expand

Steps to reproduce

1. go test ./modules/caddyhttp/caddyauth/ -run TestBasicAuth -count=1
2. Expected: unknown {...} in usernames survive as literal data, a braced password is rejected instead of silently rewritten, {env.*} placeholders still expand
3. Actual (raw output on untouched master 56e3a88):

--- FAIL: TestBasicAuthProvisionKeepsUnknownPlaceholdersInUsername (0.00s)
    basicauth_test.go:43: expected an account for the username as configured, got accounts ["alice-"]
--- FAIL: TestBasicAuthProvisionRejectsBracedPasswordInsteadOfRewritingIt (0.00s)
    basicauth_test.go:98: expected provisioning to fail for a password with literal braces, instead it accepted the rewritten password "i\xb7\x9f"
FAIL
FAIL	github.com/caddyserver/caddy/v2/modules/caddyhttp/caddyauth	0.011s

regression tests in basicauth_test.go pin all three directions: unknown braces survive, a known placeholder still expands, and a braced password fails loudly instead of becoming a different valid password

Assistance Disclosure

AI used: yes, for drafting test coverage and description formatting