Prefer BasicAuth challenge when more than one mechanism in registered and it is not possible to detect the client preference

[sberyozkin]

Description

Right now, if, for example, both Bearer token and Basic Auth mechanisms are enabled, then, if the authentication fails and the challenge is required, and it is not possible to detect the client preference, for ex, Authorization header was simply not set, and when no path specific mechanism config has been provided, then the 1st mechanism in the list will be used to create a challenge - which can be Bearer in the given example - however Basic Auth one should be preferred if it is available - as it can help with the browser challenging a user to enter the name/password

Implementation ideas

No response