Hudson ships with Winstone, so no additional installation needed. Just run with java -jar hudson.war.
Specify the -D option to the invocation:
Or if that fails for some reason, you should still be able to use the environment variable:
Winstone supports pluggable authentication as explained here. For example, to use FileRealm, you'd do:
See the list of issues filed that are specifically marked relevant to Winstone.