if the <endpoint> is configured with a security realm, authentication should be enabled automatically based on the security realm stores.
Default mechs for Hot Rod:

• SCRAM-SHA-512 SCRAM-SHA-384 SCRAM-SHA-256 SCRAM-SHA-1 DIGEST-SHA-512 DIGEST-SHA-384 DIGEST-SHA-256 DIGEST-SHA DIGEST-MD5
  Default mechs for HTTP:
• DIGEST
  *PLAIN/BASIC will only be enabled if TLS is also enabled
• EXTERNAL/CLIENT_CERT will only be enabled if TLS is enabled and require-ssl-client-auth="true"
• GSSAPI/GS2-KRB5/SPNEGO will only be enabled if a kerberos realm is present
• OAUTHBEARER/BEARER_TOKEN will only be enabled if a token realm is present