NEXUS-6356: RUT Realm might mis-idenfity user

As searchUsers were initially implemented for UI user search
use case, where "prefix search" is done.
Merge remote-tracking branch 'origin/nexus-2.8.x' into nexus-2.8.x-NEXUS-6356-rut-misidentification
NEXUS-6356: Fixing the IT

As this change fixed another RUT problem, and IT was
expecting 403 for "unknown" user. But this is wrong,
as unknown users should get 401 and not 403.

This was caused by the fact that old RUT realm checked
that set returned by SecuritySystem#searchUsers
is null. But that method never returned null
but empty set instead. So to say, if request
had RUT header set, it was taken as logged in
automatically, but maybe with empty set
of permissions.
Merge pull request #427 from sonatype/nexus-2.8.x-NEXUS-6356-rut-misidentification

[2.8.x] NEXUS-6356: RUT Realm might mis-idenfity user