fix(admin): allow the SPNEGO pre-authentication password to be cleared

[marevol]

Two gaps left by #3181 / #3220 in the General settings, both on the admin write path.

1. The SPNEGO pre-authentication password cannot be cleared

updateConfig stored the password only when the submitted value survived the mask check:

if (form.spnegoPreauthPassword != null && StringUtil.isNotBlank(form.spnegoPreauthPassword.replace("*", " "))) {

That is the same shape as the other secrets on this screen, and for them it is right: the
form renders ********** instead of the stored value, so an unchanged submission must not
overwrite it. Clearing the field simply did nothing.

For SPNEGO an empty password is not "unchanged", it is a configuration:

boolean useKeyTab() {
    return this.canUseKeyTab && this.username.isEmpty() && this.password.isEmpty();
}

#3181 changed the coded defaults for spnego.preauth.username / spnego.preauth.password
to empty precisely so a keytab-based server login would work. But once any password had been
saved through this screen, the key could never be removed again, so useKeyTab() stayed
false and the keytab setup was unreachable without editing system.properties by hand.

An absent or empty submission now removes the key. A submission made only of mask characters
is still ignored, so the round trip through updateForm keeps behaving as before, and the
other secrets are untouched.

2. The NTLM prompt rule was not applied to the API

#3220 rejects spnego.allow.basic=false together with spnego.prompt.ntlm=true, because the
SPNEGO library refuses that combination when it builds its configuration — lazily, on the
first login, so without this check SSO breaks silently long after the save. The check lived
only in AdminGeneralAction#update, so PUT /api/admin/general could still store it.

Moving the same rule into the API needs one thing beyond copying it: the API merges the
request body over the stored settings, so a request that carries only one half of the pair
takes the other half from what is already stored. The check therefore runs on the merged
body, after BeanUtil.copyBeanToBean, while the request body itself is still what gets
validated against its own bean constraints. The rule is extracted to
AdminGeneralAction#isSpnegoNtlmPromptUnsupported so both paths share one definition.

Tests

AdminGeneralActionTest: 10 tests, no failures (7 + 3).

• test_updateConfig_spnegoPreauthPassword_canBeCleared — a stored password is removed by a
  null submission (the HTML path, where LastaFlute maps an empty field to null) and by an
  empty string (the API path, which does not)
• test_updateConfig_spnegoPreauthPassword_maskKeepsStoredValue — an updateForm /
  updateConfig round trip leaves the stored password alone
• test_isSpnegoNtlmPromptUnsupported — the extracted rule

The first test fails against the previous code with expected: <null> but was: <secret>,
which is the defect it pins.

mvn javadoc:jar was regenerated from scratch: no new warnings from the touched files.