UNOMI-974: Require an explicit admin and health-check password at startup

[sergehuber]

The shipped karaf and health-check accounts fell back to a value carried in the distribution when
the operator set nothing. Both now resolve only from UNOMI_ROOT_PASSWORD and
UNOMI_HEALTHCHECK_PASSWORD, with no fallback.

Removing the fallback is necessary but not sufficient, because of how Karaf resolves properties:
PropertiesLoader and PropertiesLoginModule both substitute with defaultsToEmptyString=true, so an
unset property yields an empty value rather than an unusable account. The account must therefore be
made unusable deliberately. bin/setenv and the Docker entrypoint refuse to start when either
variable is unset, and AuthenticationFilter requires a non-blank password on any Basic credential it
accepts.

That last check runs at each point a Basic credential is consumed rather than once at the top of
filter(). The public paths and every V2 path ignore Authorization entirely, so a single up-front
check would turn a stray or stale header into a 401 on requests that must succeed anonymously.

The shell guards cannot cover every way the JVM is started - karaf.bat calls setenv.bat without
testing errorlevel, as setenv itself documents, and a systemd unit or container command override
skips them too - so the REST-layer requirement is what actually holds. The guards are executed by
the tests rather than grepped, because a check whose text is present but whose condition never
matches would otherwise pass silently.

Documentation, examples, compose files and the setup scripts no longer carry a sample password.
Operators upgrading must set both variables before starting; the 3.0-to-3.1 migration guide covers
it.

Jira: https://issues.apache.org/jira/browse/UNOMI-974