Early authentication timing failure could leak username correctness

[AaronFeickert]

When gRPC credentials are validated, an error is returned if either the username or passphrase are incorrect. However, a failed username check will fail the validation immediately without checking the passphrase. This could introduce a timing attack.

It should always be the case that both a supplied username and passphrase are validated before returning a generic error to the caller.

[AaronFeickert]

Fixed by #5902.