Require authentication for GraphQL WebSocket upgrade (unomi-3.0.x) - #844

Port of the master fix (#843) to the 3.0.x line, re-cut from current unomi-3.0.x.

A handshake that carries an Authorization header is authenticated before the
upgrade is accepted, and a foreign-origin handshake is refused, since a
WebSocket handshake is not subject to the same-origin policy. A handshake that
carries no credential - which is all a browser can send - is upgraded but the
resulting socket does nothing until it authenticates through the connection_init
payload; every other message is refused and closes the socket, and a scheduled
close ends any socket that has not authenticated within its deadline. The
shipped GraphQL UI passes the Headers-tab Authorization to the WebSocket client
as connectionParams so both transports use the same credential.

Differences from master, because 3.0.x has no tenancy or security context:
whether a socket is authenticated is a plain flag set from the remote user the
validator records on a successful handshake login, and there is no execution
context to bind around event delivery. The deadline scheduler is shut down from
the servlet's destroy(), as the creator object has no Jetty lifecycle of its
own. Close frames now carry valid codes (1000/1008) instead of 0, and the
credential payload is not logged.

Covered by integration tests only, as this line does not carry a unit-test
stack for the GraphQL module. GraphQLServletSecurityIT is now registered in
AllITs; it was never run on this line.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

JUnit resolves the types in a test class's method signatures when it scans the
class, which happens at probe start, before the test's setup has waited for the
container to finish provisioning. A helper that took a websocket-client type as
a parameter therefore made every test in the class fail to load whenever the
class ran early, as it does when selected on its own. Build the upgrade request
inside the helper instead, so the client bundle is only needed once the tests
actually run.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

…ore idle timeout

A WebSocket upgrade whose credential is refused now receives the same
WWW-Authenticate challenge as one that carries no credential, as a 401 must.
The Basic scheme token is compared case-insensitively, as HTTP authentication
schemes are. A socket that authenticates through connection_init now goes back
to the idle timeout its session was configured with instead of having the
timeout disabled, so both authentication paths share the same idle behaviour.

Adds an integration test authenticating with a lowercase scheme on the
handshake.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>