fix(activemq): add user credentials so the in-VM connection can authenticate

[natechadwick-intsof]

Summary

The T2.2 ActiveMQ hardening PR (#166/#167) configured
<simpleAuthenticationPlugin anonymousAccessAllowed="false"/> in
system/Tools/jetty/defaults/etc/activemq/activemq.xml but did not add any
users and did not update the in-VM ActiveMQConnectionFactory in
system/Tools/jetty/defaults/etc/perc-mq.xml to provide credentials. The
in-VM transport (vm://localhost) sends anonymous (no user / no password)
connections by default, so every JMS listener — PERCUSSION.EMAIL,
PERCUSSION.PUBLISHING, PERCUSSION.NOTIFICATIONS — gets
User name [null] or password is invalid and retries in a 5-second
FixedBackOff loop (currentAttempts climbs to 30+ within a minute).

This is the third regression from the T2.2 PR. The hardening intent
("auth in place so a future network listener inherits the secure
defaults") is good; the implementation forgot that the existing
in-VM callers would need credentials to authenticate against the now-
strict plugin.

Why the broker still starts

XBeanBrokerFactory does fail with Failed to load: class path resource [activemq.xml] repeatedly (see #208 / #210 / #211) but the broker
context is started programmatically somewhere else (most likely
ActiveMQContext from a Spring config that doesn't go through XBean).
The auth plugin only kicks in when a connection is attempted, hence
the 30+ User name [null] or password is invalid errors after startup
rather than a hard failure at boot.

Plan

1. In activemq.xml, add userPasswords and userGroups attributes to the
   existing simpleAuthenticationPlugin so there's a user the in-VM
   connection can authenticate as. Keep anonymousAccessAllowed="false"
   so the security posture is preserved.
2. In perc-mq.xml, configure the ActiveMQConnectionFactory to use the
   same credentials via <Set name="userName"> / <Set name="password">.
   Use Jetty's <Property> indirection so the credentials are
   overridable from a system property / start.ini without rebuilding
   the install (e.g., -Dactivemq.username=... / -Dactivemq.password=...).
3. The default credentials (used if no system property is set) are
   rhythmyx / a randomly-generated placeholder. Document the system
   property override in a comment.
4. Branch bugfix/<this-issue>-activemq-vm-credentials; commit, GPG-sign,
   push, open PR.

Verification

• After deploy + restart, the User name [null] or password is invalid
  WARN/ERROR chain disappears. The currentAttempts counter in the
  JMS listener retry messages stops climbing.
• PERCUSSION.EMAIL, PERCUSSION.PUBLISHING, PERCUSSION.NOTIFICATIONS
  listeners all reach steady-state Running (no retry, no error).
• Override the credentials via -Dactivemq.username=foo -Dactivemq.password=bar
  and confirm the broker still rejects (security posture preserved).
• xmllint --schema activemq.xsd activemq.xml --noout — exits 0.

Co-Authored by Mavis Mavis-Code using MiniMax-M3 with agent mavis.

[natechadwick-intsof]

Closing as completed by PR #213. Adding in-VM user credentials to simpleAuthenticationPlugin + ConnectionFactory.