Remove the 'ResponseFactoryInterface $responseFactory' parameter from the 'Authentication' constructor

Proposed new feature or change

The 'ResponseFactoryInterface $responseFactory' parameter is proposed for removal from the 'Authentication' constructor in order to simplify the 'Authentication' configuration, while retaining the same logic.

Current:

final class Authentication implements MiddlewareInterface
{
    // ...
    public function __construct(
        private AuthenticatorInterface|AuthenticationMethodInterface $authenticationMethod,
        ResponseFactoryInterface $responseFactory,
        ?RequestHandlerInterface $authenticationFailureHandler = null,
    ) {
        $this->failureHandler = $authenticationFailureHandler ?? new AuthenticationFailureHandler(
            $responseFactory,
        );
    }

    public function process(ServerRequestInterface $request, RequestHandlerInterface $handler): ResponseInterface
    {
        // ...
        if ($identity === null && !$this->isOptional($request)) {
            $response = $this->failureHandler->handle($request);
            // ...
        }
        // ...
    }
    // ...
}

Proposed:

final class Authentication implements MiddlewareInterface
{
    // ...
    public function __construct(
        private AuthenticatorInterface|AuthenticationMethodInterface $authenticationMethod,
        private RequestHandlerInterface $authenticationFailureHandler
    ) {}

    public function process(ServerRequestInterface $request, RequestHandlerInterface $handler): ResponseInterface
    { 
        // ...
        if ($identity === null && !$this->isOptional($request)) {
            $response = $this->authenticationFailureHandler->handle($request);
            // ...
        }
        // ...
    }
    // ...
}

//config/di-web.php
use App\Web\Auth\AuthenticationFailureHandler;
use Psr\Http\Server\RequestHandlerInterface;

return [
    RequestHandlerInterface::class => AuthenticationFailureHandler::class
];

Start with the Authentication constructor and the config/di-web.php entry shown in the issue, then trace how AuthenticationFailureHandler and RequestHandlerInterface are wired and used. Done means Authentication no longer accepts ResponseFactoryInterface, its failure handler is supplied through the handler dependency, and the existing authentication-failure behavior remains unchanged.