Make shield work with D8 core basic_auth (2)

I rerolled the patch as the MR.

With the latest fixes the last issue is this test failure:

  public function testShieldWithBasicAuth() {
    // Configure shield, so it is enabled and basic_auth headers are kept.
    // We don't need to test the case with unset_basic_auth_headers to TRUE
    // as it is the default value, it is tested by testShieldCred().
    $this->config('shield.settings')
      ->set('shield_enable', TRUE)
      ->set('unset_basic_auth_headers', FALSE)
      ->save();

    $this->drupalGet('user', [], ['Authorization' => 'Basic ' . base64_encode('user:password')]);
    $this->assertSession()->statusCodeEquals(403);
  }

The problem here is that it suggests the changes aren't working at all?

I just realized that there's no way of controlling the "unset_basic_auth_headers" setting, so it might be worth adding a separate issue for that.