Kong: anonymous authentication turns 401 into a named free tier

curl -X POST http://localhost:8001/consumers --data username=guest

curl -X POST http://localhost:8001/routes/api/plugins \
  --data name=key-auth \
  --data config.anonymous=<uuid-of-guest>

curl -X POST http://localhost:8001/consumers/guest/plugins \
  --data name=rate-limiting --data config.minute=20 --data config.policy=redis

With a key:     200, X-Consumer-Username: acme,  limit 1000/min
Without a key:  200, X-Consumer-Username: guest, limit 20/min

# config.anonymous takes the consumer's UUID, not the username, in most
# Kong versions - passing the username silently disables the fallback and
# every anonymous request goes back to 401.
#
# Chain two auth plugins with the same anonymous consumer to accept either
# credential type, then use ACL to require a real group where it matters.