critwall: use Protocol.securityMethod to decide how to authenticate download calls

[pdowler]

critwall requests both https,anon and https,cert URLs during transfer negotiation, but needs to be careful to make the call using the resulting security method (specifically, make downloads anonymously).

so, instead of the Subject.doAs(...) in run() that provides a client cert to all https requests, it should

• do a Subject.doAs in getDownloadURLs (transfer negotation) and return a List
• conditonally do Subject.doAs in syncArtifact, depending on the securityMethod

This will remove extraneous/unecessary authentication and overhead that goes with it.