Fix the audit for an AI-suggested hashing package

An assistant wrote a password hashing helper that imports securehash, a package it called "industry standard". pip install securehash worked, but nobody on the team had heard of it. Your team now runs an audit on every password hashing setup before it merges.

An assistant wrote audit_password_hash_config(library, vetted_libraries, salted, constant_time_compare). It is in the editor. It has a bug. Find it and fix it.

Input and output:

• library: the package name the code imports.
• vetted_libraries: the package names your security team has approved. It can be empty.
• salted: true when each password gets its own random salt (extra random input, so equal passwords hash differently).
• constant_time_compare: true when hashes are compared in constant time, so timing does not reveal how much matched.
• Return the list of findings, possibly empty.

Rules the tests check:

• To normalize a package name: trim whitespace at both ends, lowercase it, and turn every _ into -. Nothing else changes.
• The library is vetted when its normalized name is not empty and equals the normalized form of some entry in vetted_libraries. With an empty list, nothing is vetted.
• Findings, in this order:
  1. "salt_missing" when salted is false.
  2. "timing_unsafe_compare" when constant_time_compare is false.
  3. "unvetted_dependency" when the library is not vetted.

Examples:

• audit_password_hash_config("securehash", ["argon2-cffi", "bcrypt"], false, false) returns ["salt_missing", "timing_unsafe_compare", "unvetted_dependency"].
• audit_password_hash_config("argon2-cffi", ["argon2-cffi", "bcrypt"], true, true) returns [].
• audit_password_hash_config("Argon2_CFFI", ["argon2-cffi"], true, true) returns []: both names normalize to argon2-cffi.

Then, in a sentence or two: how would you catch this kind of bug in review?