fix: #3026257 Harden the authentication pipeline

• Flood protection now matches core: only requests that supplied credentials count towards the limit, a success no longer resets the counter, lockout happens at exactly user.flood ip_limit, and a flooded IP is denied by the access check before the protected page is built.
• The 401 challenge is only issued when the module's own credential check is what failed; denials from other access checks keep their 403 so browsers are not prompted for credentials that cannot help.
• Protected route changes made outside the settings form (drush, config import) now trigger a router rebuild.
• Authorization headers are parsed like Symfony does: non-Basic schemes and malformed values are ignored without PHP warnings.
• The response subscriber only acts on the main request and reads the route from the request attributes instead of re-matching the path.
• The settings permission is flagged restrict access, the normalize post_update preserves per-route credentials, and unresolvable password keys surface as a status report error.
• README documents the flood behavior and the reverse proxy requirement for correct client IPs.

Closes #3026257