caddyauth: add candidate placeholders for rejected identities

[steadytao]

Reimplementing the fix for 7684 while using the correct placeholder.

• Preserve http.auth.user.* for successfully authenticated principals only
• Add http.auth.candidate.* when an authentication provider returns user information but authentication is rejected
• Avoid exposing candidate placeholders for successful authentication or empty rejected users
• Add caddyauth tests covering candidate placeholders, user placeholders and rejected candidate leakage

Fixes #7684.
Closes #7687.

Assistance Disclosure

No AI was used.