One Time Token user lookup should fail with BadCredentialsException

[jzheaux]

When credentials fail authentication, Spring Security conventionally throws BadCredentialsException.

OneTimeTokenAuthenticationProvider should catch UsernameNotFoundException, wrap it, and rethrow as BadCredentialsException.

[jzheaux]

Closed in favor of #16506