Support for combining OIDC with other auth mechanisms

[sberyozkin]

Related to #11886.
This PR fixes a minor issue in the OIDC code (returning 'null' token credentials when no token is available) to have the OIDC service authentication combined with the other auth mechanims (basic, etc). Note I've updated the test and changed Principal to SecurityIdentity - this is because smallrye-jwt ships a (JsonWebToken) Principal producer and, with the basic auth, it returns a null name.

@gsmet I think it is a bug fix, but it is not an urgent fix as some more work needs to be done around #11886, hence not adding a backport label

[pedroigor]

@sberyozkin Is returning an empty credential instance from the producer OK? Why not just return null as it stands today?

[sberyozkin]

Hi @pedroigor
Right, yes, keeping it as it is now prevents combining OIDC with the other authentication mechanisms which is a nice feature added by Stuart @stuartwdouglas. Example, see the linked issue (its scope is a bit different, there is a requirement to enable Basic for a given path only but combining the mechanisms is a prerequisite). It will also block the cases where one of the JAX-RS methods is @permitAll and the service code has an injected JsonWebToken/TokenCredential.
Hence returning a Null JsonWebToken/TokenCredential instance when no token is available is needed for a RequestScoped bean injection to work (null is not allowed - this is for injecting TokenCredentials, while with JsonWebToken we throw an exception which is also a problem).
I don't think either BearerAuthenticationMechanism or CodeFlowAuthenticationMechanism are affected as they block the requests without tokens :-), we have Bearer and Code flow tests asserting it I believe.
What do you think, does it clarify it ?

[sberyozkin]

@stuartwdouglas thanks; @pedroigor I'll merge then, as I said, it is simply a RequestScoped requirement, ping me if you still have some concerns :-)

[Kirbylix]

Hello,

is there a guide how i use oidc (keycloak) and basic auth together ?
regarding this task