cred: add HEAD support for generate endpoint

[pdowler]

tweak internal IdentityManager to filter out X509 security methods from original IM

[pdowler]

HEAD: since clients will see the /cred/generate URL in challenges from other services, I wanted HEAD to work there. From my test deploy:

curl --head https://haproxy.cadc.dao.nrc.ca/cred/generate
HTTP/2 200 
server: OpenCADC/cadc-rest
www-authenticate: Basic realm="https://haproxy.cadc.dao.nrc.ca/cred"
www-authenticate: ivoa_cookie
www-authenticate: ivoa_bearer standard_id="ivo://ivoa.net/sso#tls-with-password", access_url="https://ws-cadc.canfar.net/ac/login", HACK=temporary
www-authenticate: Bearer

Note that the filtering out of cert support in the internal IdentityManager wrapper causes this to not emit ivoa_x509 challenges. I think this is more correct because no one can use a cert to get a new cert for the same identity (yes, internally an admin cert can be used, but there's no way or need to advertise that subtle bit).

[andamian]

Copyright years were not updated but I leave it up to you if you want to do it but if you do, you might also want to put a comment with the reason the cert option is excluded. It looks good otherwise.

[pdowler]

I will fix, especially the comment