[HttpFoundation] Basic auth in url is broken when using PHP CGI/FPM

Request#getUser() and Request#getPassword() introduced in
aecfd0a8917370edd237120352749141ffa85362 do not handle the lack of
PHP_AUTH_USER and PHP_AUTH_PW in $this->server when using PHP-FPM. Use
$this->headers instead.
Furthermore, the test of empty password now expects an empty string
instead of NULL according to a450d002f253e32e77d5c2bd3e490435c68a8c09.
bug #11092 [HttpFoundation] Fix basic authentication in url with PHP-FPM (Kdecherf)

This PR was merged into the 2.3 branch.

Discussion
----------

[HttpFoundation] Fix basic authentication in url with PHP-FPM

| Q             | A
| ------------- | ---
| Bug fix?      | yes
| New feature?  | no
| BC breaks?    | dispute
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | n/a
| License       | MIT
| Doc PR        | n/a

`getUser()` and `getPassword()` from `Request` are broken when using PHP-FPM because of the lack of `$_SERVER['PHP_AUTH_USER']` and `$_SERVER['PHP_AUTH_PW']`. This PR fixes the issue.

However, now an empty password will return an empty string (which is the expected behavior of `ServerBag`) instead of `NULL`. The test is updated accordingly, but should we consider this as a breakage?

This issue was spotted by using basic auth via the Illuminate component of Laravel and is present from v2.1.0 to master.

Commits
-------

7a75adf [HttpFoundation] Basic auth in url is broken when using PHP CGI/FPM