Address AuthenticationPlugin TODO redeclare params as HttpServletRequest & HttpServletResponse

This was noted in SOLR-11692 and then I think the surrounding code change more in SOLR-12290, but the TODO remained unaddressed. We can declare this as HttpServletRequest/Response and all of the usages still work. There are plenty of implementations where we just do a cast anyway, and don't even do instanced checks.

I noticed this change for an external auth plugin that I'm working on that appears to have issues handling casts between ServletRequest and the CloseShield wrapper classes.