Install AuthModule in the sys injector under a WAR deployment

WebAppInitializer installs AuthModule in the web injector, but
AuthModule binds sys-level state: OAuthTokenCache and, once added, the
OAuthTokenEncrypter DynamicItem whose itemOf is declared in
GerritGlobalModule (sys). The ssh command injector that will host the
oauth-token commands is a sibling of web, not a child. Under a
servlet-container WAR, an AuthModule in the web injector would be
invisible to the sys itemOf and to the ssh injector, silently disabling
stored-token encryption and breaking the SSH commands.

Daemon already installs AuthModule in createSysInjector; the WAR path
was the outlier. Move it there so the injector graphs match, before the
encrypter and the oauth-token SSH commands land, so every later change
works under both deployments. The web injector loses nothing: web is a
child of sys and still resolves Realm and AuthBackend from the parent.
This complements declaring DynamicMap<OAuthServiceProvider> in sys;
both move OAuth wiring out of the web injector so it is reachable
everywhere.

Feature: Issue 560182135
Release-Notes: skip
Change-Id: I745fa4b3bf534cf106925eebf4b9fd91117a77f5