All operations under the /admin endpoint should require admin role

[jsenko]

The following operations do not currently follow this principle:

/admin//artifactTypes GET (READ)
/admin/rules GET (READ)
/rules/{rule} GET (READ)

We can either:

• Simply require the admin role.
• Move only these operations under the /system endpoint.

For 2.x, this would be a breaking change, but we should change this for 3.x .

[apicurio-bot]

Thank you for reporting an issue!

Pinging @EricWittmann to respond or triage.

[jsenko]

Also, we should rename the default OAuth scopes

sr-admin, sr-developer, sr-readonly

to

apicurio-admin, apicurio-developer, apicurio-readonly

[EricWittmann]

Let's also audit the ccompat API to make sure the annotations are correct for access privs.

[EricWittmann]

Done and done:

• chore(annotations): Reviewed annotations in the REST layer #5512

Note: we didn't rename the OAuth scopes for 3.0 and at this point it would be a breaking change, so we'll have to live with it as-is.