Rename and comment test file for a more accurate description
Anonymous basic auth support in tests

To use, supply basic_auth => 'anon' to RT::Test->started_ok.

This provides a way to pass arbitrary REMOTE_USER values into RT from
tests, which enables testing of RT's responses in mixed auth
environments.  Without this, all tests for auth declined responses
(401/403 statuses) come from the auth layer rather than RT.
Failing tests for deauthenticating when REMOTE_USER disappears
Cleanup WebExternalAuth handling

This standardizes on a 403 Forbidden response and avoids ever sending a
login page with no form.
Deauthentication under continuous external auth with internal fallback

Under WebExternalAuth configurations with both WebExternalAuthContinuous
and WebFallbackToInternalAuth enabled, RT now properly logs out
externally authed users who are deauthenticated outside of RT during their
RT session.

Previously this configuration checked for REMOTE_USER on every request,
but still allowed users to remain logged in even after they stopped
being authenticated by the external source.  WebFallbackToInternalAuth
prevented WebExternalAuthContinuous from working properly, presumably in
order to let internally authed users stay logged in despite their lack
of REMOTE_USER.

By setting a flag on externally authed users' sessions, we can
differentiate between those users and users who logged into RT directly.
This difference lets us enforce WebExternalAuthContinuous for only the
external users, as intended.
Standard error pages for all reasons we abort external auth

Instead of a blank page, show brief, friendlier error messages with
information about why auth failed, contact information for the local
admin, and an internal login link when fallback is on.  Rendering each
error as an individual component allows easier site-specific overrides
for customizing messages to the external authentication system in use.

Behaviour under WebFallbackToInternalAuth is changed from showing login
pages with no message on failure to showing an error message with a way
to login.  Below is a summary of the new behaviour for each reason we
abort and force logout during WebExternalAuth checking.  All error pages
are 403s and provide a login link if Fallback is ON.

User doesn't exist and auto-create is OFF
    Fallback  ON: Error page, since if they were supposed to login it would
                  likely be linked to remote user

    Fallback OFF: Error page

Fail to auto-create a user (iff WebExternalAuto is ON)
    Fallback  ON: Error page with "couldn't create user message", since they're
                  unlikely to be able to do anything about it.

    Fallback OFF: Error page with "couldn't create user" message

User logged in but deauthed by external system (iff WebExternalAuthContinuous is ON)
    Fallback  ON: Error page, suggesting refresh. Next page hit gets them
                  logged in again if it was a blip or the login form if it wasn't.

    Fallback OFF: Same error page as above, except they'll get the generic
                  error page below if it wasn't a blip when they refresh.

No remote user
    Fallback  ON: Login page
    Fallback OFF: Error page, generic
Ignore REMOTE_USER if we're logged in with internal auth

This prevents logged in internally-authed users from being logged out if
they pick up a REMOTE_USER.  Viewed another way, it lets users with an
invalid REMOTE_USER still login with internal credentials.

All tests in t/web/remote_user.t now pass.
Refactor the generation of login tangent links

This avoids the error wrapper needing to know the details of how login
tangents work.
Tests for the WebExternalAuto and AutoCreate options

One test fails (creating privileged users by default) and is marked TODO
because of a longstanding bug.
Allow Privileged and Disabled to be set from WebExternalAutoInfo()

Fixes a regression introduced by e2ec2c4c in 2009.  The change to
WritableAttributes was the correct approach (and let us pick up new
columns automatically), but it missed that Privileged and Disabled
aren't true User columns handled by DBIx::SearchBuilder.

Privileged is particularly important since the default implementation of
WebExternalAutoInfo() expects to be able to return it in order to make
externally authed auto-created users Privileged by default.  The bug
meant the default behaviour didn't work and you had to include
Privileged => 1 in $AutoCreate if you wanted privileged users.
Document the various external authentication solutions

Focusing on $WebExternalAuth, but also touching on
RT::Authen::ExternalAuth and RT::Extension::LDAPImport.  Hopefully this
provides a useful overview of the options available, since most folks
don't seem to realize RT can integrate with your web server's auth.
Refactor setting an Authorization header into RT::Test::Web
Move logged_in_as into RT::Test::Web instead of copying parts of ->login
Reference the new external auth docs from an error message

Useful to know if you want to turn on auto-creation, or import from
LDAP, etc.
Wordsmithing from Jim and I for clarity
Reorganize the authentication docs with better headings

Since the file is now a bit more generic than just external auth and
should be left room to grow, rename to authentication.pod.
Update doc pointer in authentication error
Consistently use "internal" to describe RT's own authentication

We use internal vs. external all over the place, not native vs.
external.
Merge branch '4.2/web-external-auth'