APM, use HTTP basic auth semantics to retrieve e.g. RSA credentials?

Should be able to do that.

[HTTP::username] and [HTTP::password] extracts the credentials from the header

https://devcentral.f5.com/wiki/iRules.HTTP__username.ashx

iRule can be used to map the username(401 agent updates username directly ) and password session variables. This can be followed by the radius agent.

when ACCESS_POLICY_AGENT_EVENT {    
        ACCESS::session data set session.logon.logon.username [HTTP::username] 
        ACCESS::session data set session.logon.logon.password [HTTP::password] 
}