+htp #15933 import SecurityDirectives (+ infrastructure) from spray

The main change from spray is that `authenticate` directive was completely replaced by the actual authentication mechanism. (In spray, there was the `ContextAuthenticator` type which was very similar to a directive but not quite.)

Implementation of directives for doing Http authentication (i.e. using the `Authorization` and `WWW-Authenticate` headers as defined in [RFC 7235](http://tools.ietf.org/html/rfc7235)) now live in `HttpAuthentication` which provides low-level facilities to build authenticators directives as well as the one currently supported authentication method, Http Basic Authentication ([RFC 2617](http://tools.ietf.org/html/rfc2617)).

Support for optional authentication as proposed in spray/spray#876 is supported by wrapping another authentication directive (like HttpAuthentication.Basic) with `optional`. In a similar way, an anonymous user object can be supplied. Also spray/spray#938 which was recently raised by @choffmeister was addressed by providing a set of  entry points in `HttpAuthentication` depending on the level of support you need and by allowing  to implemented a new authentication method by just supplying one function to do the authentication.

For now, I stripped off support for supplying credentials as configuration. I can put it back in if someone finds that we should provide it. It probably doesn't scale but may be useful for quick one-user configuration in some cases.

Based on #16157. Fixes #15933.

/cc @sirthias
maybe `verifySecret` would convey even better that there is actual (and "heavy-lifting" :) work being done to perform a secure check?