Short cleartext (CL:) passwords were compared with ctmemcmp over
pwl_table.recsize-1 bytes, reading past the client password buffer and
rejecting valid short passwords. Compare only password bytes plus NUL.
Co-authored-by: Cursor <cursoragent@cursor.com>
