feat: Issue #2923801: Let requests authenticated by basic_auth pass Shield.

Adds an opt-in "Allow HTTP basic authentication" setting. When it is on and the basic_auth module is installed, a request that does not carry the Shield credentials but does carry the user name and password of a Drupal account is let through, so REST and other web service clients -- which can only send one set of basic auth credentials -- can reach the site while Shield is enabled.

The credentials are verified by core's basic_auth provider rather than checked here, so flood control, blocked accounts and password hashing are all core's. The setting defaults to FALSE, and shield_update_8011() sets that default on existing sites, so no site's security posture changes on update.

The result of the basic_auth check is now memoised per request, as both the new bypass and the existing unset_basic_auth_headers handling in bypass() need the answer and repeating it would cost a second password hash and a second flood event.

Credit to dfarouk for the original report and to damienmckenna for the reroll: the diagnosis in MR !22 (closed) was right, but its implementation called PasswordInterface::check() directly, which bypasses flood control and the blocked account check, and it was unconditional whenever basic_auth was installed.

Closes #2923801