ws: In preparation for GSSAPI move authentication to headers

Use the standard Authorization header and Basic auth for authenticating
via passwords.

We parse the authorization header in cockpit-session, similarly to how
we'll be doing for the GSSAPI (ie: kerberos auth)
ws: Pass headers to CockpitAuth login_finish() virtual method

In our GSSAPI authentication we'll be adding custom headers from
the implementations of this virtual method.
ws: Remove support from CockpitWebServer for handling POST reqs

This is no longer used or needed. Conceptually we should never be
handling POST requests because we have no CSRF protection, or anything like
that anyway.

Anything that changes state should go through thet WebSocket.

Closes #1114