Fix: Return 401 instead of 500 for empty credentials

[Copilot]

Empty username or password returns HTTP 500 instead of HTTP 401, leaking information about credential handling and enabling enumeration attacks.

Changes

• UnityAuthenticationProvider.authenticate(): Added early validation for null/empty credentials before processing, returning CREDENTIALS_DO_NOT_MATCH failure consistent with other auth failures

if (authenticationRequest.getIdentity() == null ||
    authenticationRequest.getIdentity().toString().isEmpty() ||
    authenticationRequest.getSecret() == null ||
    authenticationRequest.getSecret().toString().isEmpty()) {
  return Mono.just(AuthenticationResponse.failure(CREDENTIALS_DO_NOT_MATCH.toString()));
}

• Tests: Added login_failsWithEmptyPassword() and login_failsWithEmptyUsername() to verify 401 response

Original prompt

Address issue #40

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.