Improve RTSP server authentication handling and auditing

[subbyte]

In the latest version (v1.9.7), when using the RTSP module/server, a client fails authentication silently, which makes it very vulnerable to RTSP brute force attack:

• There is no log of failed RTSP authentication
• An attacker can test multiple RTSP requests with different credentials in a single TCP connection

This RP adds "failed auth" logging for rtsp server. In addition, the PR prevents an attacker packs many brute force authentication attempts into one TCP connection. After one authentication failed, the TCP connection will terminate, forcing the attacker to start a new TCP connection for the next brute force attempt, which makes it possible to be identified and blocked by a firewall like pf.

Note ffmpeg and ffmpeg-based players, e.g., mpv, have a special authentication behavior---even if username/password is provided in the URL, the first request does not include it, resulting in a failed authentication, while all subsequent requests (in the same TCP connection) add the authentication field in the header, resulting in successful authentications.

[AlexxIT]

Thanks!

[AlexxIT]

https://github.com/AlexxIT/go2rtc/releases/tag/v1.9.9