HTTP 1.1 authentication challenge

Pinot broker doesn't follow the HTTP 1.1 authentication challenge standard.
The workflow is describe here : https://developer.mozilla.org/en-US/docs/Web/HTTP/Authentication
and is also used by the java standard HttpClient.

It prevents from correctly authenticate to the broker using code like this :
```kotlin
val request = HttpRequest.newBuilder(URI.create("https://secured_broker:8099/query/sql"))
.header("Content-Type", "application/json")
.header("Accept", "application/json")
.build()

val client = HttpClient.newBuilder()
.authenticator(object: Authenticator(){
override fun getPasswordAuthentication() = PasswordAuthentication("login", "password".toCharArray())
})
.build()

val result = client.send(request, HttpResponse.BodyHandlers.ofInputStream())
print(result)
```

Java client first try the request without Authorization header. And then resend the request with the Authorization in case of 401.
Currently, broker seems to only return 403 Http code which is a dead end from the java client perspective

Start at the Pinot broker's HTTP authentication handling and compare its 401/403 behavior with the HTTP Authentication workflow and Java HttpClient sequence described in the issue. Done when an unauthenticated request receives the challenge response needed for the client to resend credentials, and the Kotlin example can authenticate successfully.

Written by the indexing model from the issue text.