- Use stdlib crypto/pbkdf2 instead of golang.org/x/crypto/pbkdf2 for
password/secret hashing (output unchanged; no migration needed).
- Restrict JWT signing to RSA/RSA-PSS and reject other methods in
pkg/token (default RS256 unchanged).
- Remove unused common/utils/email package (no references in codebase).
Signed-off-by: wang yan <yan-yw.wang@broadcom.com>
Co-authored-by: wang yan <yan-yw.wang@broadcom.com>