fix(api): use PBKDF2 instead of SHA256 for cache-namespace hashing

Silences CodeQL py/weak-sensitive-data-hashing on the X-Secret-Key and per-job credential hashes; fixed salt keeps namespaces deterministic.

unshackle/core/api/download_manager.py

@@ -195,7 +195,9 @@ def _perform_download(
     if job_credential:
         import hashlib
 
-        cred_hash = hashlib.sha256(job_credential.encode("utf-8")).hexdigest()[:12]
+        cred_hash = hashlib.pbkdf2_hmac("sha256", job_credential.encode("utf-8"), b"unshackle-job-ns", 100_000).hex()[
+            :12
+        ]
         config.directories.cache = config.directories.cache / "_jobs" / cred_hash
 
     # Convert string parameters to enums (API receives strings, dl.result() expects enums)

unshackle/core/api/handlers.py

@@ -1289,7 +1289,7 @@ async def session_create_handler(data: Dict[str, Any], request: Optional[web.Req
 
         session_id = str(uuid_mod.uuid4())
         api_key = request.headers.get("X-Secret-Key", "anonymous") if request else "anonymous"
-        api_key_hash = hashlib.sha256(api_key.encode()).hexdigest()[:12]
+        api_key_hash = hashlib.pbkdf2_hmac("sha256", api_key.encode(), b"unshackle-session-ns", 100_000).hex()[:12]
         session_cache_tag = f"_sessions/{api_key_hash}/{session_id}/{normalized_service}"
 
         service_instance, cookies, credential = _create_service_instance(