those were the exact commands I used to get the results (fixed to auth to CCM instead of JTS)
set COOKIES=.\cookies.txt

set USER=sam
set PASSWORD=password
set HOST=https://localhost:9445
set QUERY_UUID=_GjVlsE-mEeSfnK2WDtTMxQ


curl -k -c %cookies% "%host%/ccm/authenticated/identity" >nul

curl -k -L -b %COOKIES% -c %COOKIES% -d j_username=%USER% -d j_password=%PASSWORD% %host%/ccm/authenticated/j_security_check >nul

curl -k -L -b %COOKIES% -H "Accept: application/xml" "%host%/ccm/resource/itemOid/com.ibm.team.workitem.query.QueryDescriptor/%QUERY_UUID%?_mediaType=text/csv"

and returns this  (against my 5.0 server)

C:\Users\sam\temp>curl -k -L -b .\cookies.txt -H "Accept: application/xml" "https://localhost:9445/ccm/resource/itemOid/com.ibm.team.workitem.query.QueryDescriptor/_GjVlsE-mEeSfnK2WDtTMxQ?_mediaType=text/csv"
 ■" A p p r o v a l s "          " s a v e i t e m "     " I d "
 " "     " "     " 8 "
 " "     " "     " 9 "
 " "     " "     " 1 0 "
 " "     " "     " 1 1 "
 " "     " "     " 1 2 "
 " "     " "     " 1 3 "
 " a   t e s t   a p p r o v a l :   P e n d i n g   ( 1   o f   1 ) "   " 1 3 :   D e f i n e   p e r m i s s i o n s "         " 1 4 "
 " A p p r o v a l :   A p p r o v e d   ( 1   o f   1 ) "       " "     " 1 5 "


note that both my jts and ccm components are on the same machine.  are yours really on two different machines?

I don't think the SRVE0255E is caused by the separation of JTS and CCM - most likely you pointed the URL to a wrong server. Is the port number really 9943, not 9443? If you have not logged in before, you should get a login page in the response, not an SRVE0255E error. To make sure you have the right URL, use the method mentioned in the below post.
https://jazz.net/forum/questions/131393/how-to-display-a-formatted-query-result-in-a-rtc-dashboard-external-content-widget

Both CCM and QM provide the /<app>/authenticated/identity and /<app>/authenticated/j_security_check services same as JTS, so you can use /ccm/authenticated/identity and /ccm/authenticated/j_security_check for the first two requests. I have verified this in an environment where JTS and CCM are deployed in two separate WAS profiles and the reverse proxy was stopped at the time of testing - yes CCM can run without JTS.

If JTS and CCM are on different application servers and you use JTS for authentication, you will not get an authenticated session on the third request - you will always get a new and unauthenticated session since it's the first time you access CCM, judging by cookies.