junit.http: Extract AppServerBase to dedupe the EE8 AppServer overlay

The EE8 servlet bridge ships a hand-maintained
org.eclipse.jgit.junit.http.ee8 AppServer because the canonical
AppServer cannot be rewritten into its EE8 form automatically: the Jetty
security API (Constraint.Builder + ContextHandler juggling) differs
structurally from the Jetty EE8 one (ServletConstraint +
setSecurityHandler), which a jakarta->javax string rewrite cannot
bridge. The overlay was a 461-line copy; only ~40 lines diverge.

Split the common code into an abstract AppServerBase and reduce both
AppServers to the generation-specific part:

  AppServerBase            common server/context/login wiring plus the
                           protected abstract configureAuthentication()
                           method; transform-safe (only the
                           ServletContextHandler import renames ee10 ->
                           ee8).
  AppServer (canonical)    EE10: Constraint.Builder + setHandler.
  AppServer (ee8 overlay)  EE8: ServletConstraint + setSecurityHandler.
                           461 -> 103 lines.

Both toolchains pick AppServerBase up for free: the Bazel transform and
the Maven antrun copy both exclude only the file name AppServer.java, so
AppServerBase.java flows through the jakarta->javax / ee10->ee8 rewrite
while the hand-written EE8 AppServer.java stays the overlay. No BUILD or
pom changes. The class stays named AppServer in both worlds (separate
classpaths), so every "new AppServer(...)" site is untouched.

Moving the shared username/password constants into AppServerBase turns
the AppServer.username uses in the HTTP tests into an indirect static
access, which JGit's ecj settings escalate to a compile error (caught by
Maven, not by the Bazel javac build). Reference the declaring class
(AppServerBase.username) instead of re-declaring the constants on both
AppServers, which would reintroduce the duplication this change removes.

Alternative considered: renaming the EE8 overlay to EE8AppServer.
Rejected because a distinct name forces rewriting every
"new AppServer(...)" site in the transformed EE8 tests and couples the
transform to class names instead of imports.

Copyright is carried over unchanged from the split file.

Change-Id: I1d68bcc7d1d23668696ee91d8910f4940064bb37