Allow both username and password to be passed as URL parameters when connecting

Is your feature request related to a problem? Please describe. I use a custom PAM stack which allows one-time tokens to be used when logging in (similar to e.g. https://github.com/bolkedebruin/pam-jwt ). This allows for login flows where users can connect and authenticate securely with a single button click when they have e.g. an SSO session on the server. Ideally, credentials should still be passed as encrypted header parameters or a POST body, but given the design of NoVNC and how it already allows for passwords to be sent as URL parameters it seems like allowing both username and password to be sent in the same way would be reasonable.

Describe the solution you'd like I think the solution introduced in https://github.com/novnc/noVNC/pull/2052 is sufficient to address this, but this PR was closed. I think the motivation given when closing this PR does not consider the use-case I give here.

Describe alternatives you've considered I can't think of any other way to send parameters with a single click that would be accessible to the browser client. The only alternative solutions I can think of involve some other modification to noVNC and hosting it using e.g. a templating engine that injects the password.

Given that NoVNC already supports regular VNC passwords, which are much less secure, I don't see this as a major security issue, but requiring e.g. an additional "insecure" flag to be set along with username and password would be fine with me. As with all things it's a matter of how you use it.