Add test 2108 covering the rejection over FTP. Drop the now-vestigial nul bytes from test 1282; they exercised the removed Kerberos FTP security buffer check and now trip this rejection before the 633 login-denied path is reached. Closes #21996
