Add NextAuth/Auth.js JWE session token module

[liquidsec]

• New NextAuth passive module: checks NextAuth.js v4 / Auth.js v5 dir JWE session cookies for a known or weak NEXTAUTH_SECRET / AUTH_SECRET. Handles both A256GCM (v4, empty HKDF salt) and A256CBC-HS512 (v5, cookie-name salt), and reassembles chunked …session-token.0, .1, … cookies before carving.
• Adds JWE helpers to helpers.py (b64url_decode, parse_jwe_compact, hkdf_sha256, jwe_decrypt) plus a nextauth_secrets.txt wordlist.
• README: module table row, modules_loaded entry, and a runnable example.
• Second commit, unrelated: grow the password list to top 250k, and cache + dedup wordlist loads in load_resources so a large list is read and deduped once per process rather than on every check_secret call.

Known limitation: Auth.js v5 custom session-cookie names aren't covered, since check_secret() receives only the cookie value, not the name.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 99.45%. Comparing base (f5b67ea) to head (77231fc).
⚠️ Report is 9 commits behind head on dev.

Additional details and impacted files

@@           Coverage Diff           @@
##              dev     #431   +/-   ##
=======================================
  Coverage   99.45%   99.45%           
=======================================
  Files          30       30           
  Lines        3102     3102           
=======================================
  Hits         3085     3085           
  Misses         17       17           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.