Fail fast when UserDetailsService returns null in onLoginSuccess

[skdas20]

When the successful Authentication carries no credentials, onLoginSuccess falls back to looking the password up through the configured UserDetailsService, but dereferences the result without checking it:

UserDetails user = getUserDetailsService().loadUserByUsername(username);
password = user.getPassword();

A UserDetailsService that returns null rather than throwing UsernameNotFoundException therefore shows up as a bare NullPointerException from inside the remember-me filter, with nothing in the stack trace pointing at the service that is actually misconfigured.

processAutoLoginCookie in this same class already guards the identical call, and is explicit about what a null return means:

UserDetails userDetails = getUserDetailsService().loadUserByUsername(cookieTokens[0]);
Assert.notNull(userDetails, () -> "UserDetailsService " + getUserDetailsService()
        + " returned null for username " + cookieTokens[0] + ". "
        + "This is an interface contract violation");

autoLoginClearsCookieIfUserServiceMisconfigured pins that behaviour in the tests. This change applies the same guard to onLoginSuccess so both lookups report the misconfiguration the same way, and adds loginSuccessFailsIfUserServiceMisconfigured alongside the existing loginSuccess tests. Without the production change that test fails with the reported NullPointerException.

One note on the approach: gh-19535 suggests skipping cookie generation instead, with

password = (user == null) ? password : user.getPassword();

I went with the existing in-class precedent rather than that, because silently continuing would quietly swallow a misconfiguration that the class elsewhere treats as a contract violation — and the user would get no remember-me cookie with no indication why. Happy to switch to the lenient form if you'd rather keep onLoginSuccess tolerant; it's a small change either way.

Closes gh-19535