fix: Adapt FreshRSS login to reversed challenge order

FreshRSS upstream commit 476e57b reversed the concatenation order
of the bcrypt hash and nonce in the login challenge for safer
password evaluation. Update our challenge computation to match
the new hash+nonce order.

check_updates.py

@@ -400,7 +400,7 @@ def authenticate_service(service: ServiceConfig, timeout: float, user_agent: str
         if len(password_bytes) > 72:
             password_bytes = password_bytes[:72]
         first_hash = bcrypt.hashpw(password_bytes, salt1.encode("utf-8"))
-        combined = (nonce + first_hash.decode("utf-8")).encode("utf-8")
+        combined = (first_hash.decode("utf-8") + nonce).encode("utf-8")
         if len(combined) > 72:
             combined = combined[:72]
         challenge = bcrypt.hashpw(combined, bcrypt.gensalt(rounds=4))