Specify behaviour for Principal when nobody is logged in, CDI EE

**Is your feature request related to a problem? Please describe.**
From https://github.com/jakartaee/cdi/issues/769,

[@benjamin-confino](https://github.com/benjamin-confino) I recently had a customer ask why we have CDI inject a Principal containing saying unauthenticated when `HttpServletRequest.getUserPrincipal()` will give a `null` in that context.

I think that unauthenticated is the correct choice for CDI, since we cannot inject a null and hope for it to remain up to date as the context changes, but I think it would be useful to clarify the spec on this point as the current behaviour is undefined.

**Describe the solution you'd like**
We need to clarify the behavior. From [CDI-769](https://github.com/jakartaee/cdi/issues/769), comment from [@Ladicek](https://github.com/Ladicek):
What seems a bit weird to me is that the specification doesn't define the scope of the Principal bean. I guess it should be @RequestScoped, and that itself actually precludes a null value.

Start by reading the linked CDI-769 discussion and the current CDI specification text governing the injected Principal. Clarify the bean scope and the value when nobody is authenticated; done means the specification explicitly defines this behavior and resolves the null-versus-unauthenticated question.

Written by the indexing model from the issue text.