[DNM] server: require web login by default in secure mode

[vilterp]

Note: this change or something like it is required for web login to work, but shouldn't be merged before a UI login screen exists.

Before this change:

• Admin server endpoints don't care whether there is a logged-in user or not, even in secure mode; they always run as the root user (server: Run API requests as authenticated user #8767)
• There is no way to log in — the /_auth/v1/login endpoint 404s

After this change:

• Admin server endpoints require some user to be logged in, although they still run queries (e.g. against crdb_internal) as the root user.
• /_auth/v1/login is exposed, allowing clients such as the admin UI to log in.

UX note: some users might want a cluster which is in secure mode but doesn't require web login. To support that, we'd need to introduce a new cluster setting, e.g. disable_web_login. do not merge this until we've made that decision.

Implementation note: Flipping this boolean causes the authentication mux to be installed on the server when in secure mode, which (a) handles the login endpoint and (b) checks requests to the admin and status servers for a valid session. Here's where it's installed:

cockroach/pkg/server/server.go

Lines 1181 to 1184 in 75d44eb

	var authHandler http.Handler = gwMux
	if s.cfg.RequireWebSession() {
	authHandler = newAuthenticationMux(s.authentication, authHandler)
	}

[cockroach-teamcity]

This change is 

[vilterp]

Superseded by #25057