Safari not prompting for basic authentication
Well since I can't find a definitive public answer, I'll do the next best thing.  This is the response I got on a private bug report through Apple:


  This behavior is expected. Following the fix per another bug. We do not prompt for credentials whenever navigating to an insecure web page that requires authentication from a secure web page. Moreover, we do not prompt for credentials when loading an insecure subresource (say, an image) that requires authentication or a secure subresource that requires authentication through an insecure redirect on a secure web page. The motivation for these restrictions is to prevent phishing attacks by a networking attacker who could have replaced the contents of the insecure resource HTTP response with a secure redirect to their own server that prompts for credentials. Although the authentication prompt shows the URL being accessed, a person may not read the prompt closely or, more likely, an attacker can purchase a domain name that could lull a person into falsely believing that the URL is legitimate so that the person submits their credentials to the attacker.


I'm still looking for a public statement from Apple that can be linked to.  If someone can provide that I will mark that as the accepted answer.

UPDATE

Someone with authority at Apple got in touch with me about this.  They finally linked me to the official release document showing the changed behaviour: 


  Changed to only allow non-mixed content protected sub-resources to ask for credentials.
  https://webkit.org/blog/8035/release-notes-for-safari-technology-preview-44/
  https://developer.apple.com/safari/technology-preview/release-notes/#r44


We worked with Apple to address the broken user experience caused by this security fix. Apple listened to our feedback and fixed the credentials dialog for links from an HTTPS resource to an HTTP hosted resource. It works correctly now in Safari on Mojave onwards.