fixes: #23360

It's possible that auth mechanism resumes request during the challenge (like form auth mechanism) and `HttpAuthenticator` also tries to resume request. That's not a problem with `Http1xServerRequest`, however `Http2ServerRequest` valides state and throws `IllegalStateException` and request gets stuck (never responds). We should be more careful and only resume request when needed.