ws: Optionally return headers in HTTP error responses

Reviewed-by: Marius Vollmer <marius.vollmer@redhat.com>
ws: Add ability to return headers from CockpitAuth code

Reviewed-by: Marius Vollmer <marius.vollmer@redhat.com>
ws: Refactor CockpitCreds into its own class

This way we can avoid copying credentials, and start to abstract
the different kinds of credentials that result from different kinds
of authentication.

Reviewed-by: Marius Vollmer <marius.vollmer@redhat.com>
ws: Make CockpitAuth 'authenticate' signal

And make the fallthrough authentication in test-server
be a handler for it.

In the future this will let us have multiple authentication
handlers handling the headers.

But this also lets us get rid of the fallthrough code in
cockpit_auth_check_headers() which was very dangerous.

Reviewed-by: Marius Vollmer <marius.vollmer@redhat.com>
ws: Use 401 as the 'Authentication Failed' HTTP status

401 is the HTTP not-authorized status. 403 is forbidden, which is
something very different, although we should handle that correctly
at some point as well.

Reviewed-by: Marius Vollmer <marius.vollmer@redhat.com>