feat(backend): Introduce handshake & extract logic auth logic to separate classes

[dimkl]

Changes made in this PR

• Drop Clerk::SDK#interstitial method (it should not be used by any customer since this is internal)
• Replace the interstitial mechanism with the handshake mechanism
• Extract logic from the RackMiddlewareV2 to AuthenticateRequest class
• Extract data used from the request and the configuration to AuthenticateContext class (Parameter object pattern)
• Introduce constants module to centralize and re-use the constants value used across the SDK

Customer impact

• Interstitial HTML page rendered when we cannot determine the request state is replaced with 2 HTTP 307 redirects
• Introduced CLERK_PUBLISHABLE_KEY env which is required for the handshake to work properly
• CLERK_SECRET_KEY should use the format sk_test | sk_live format

TODO

• Add tests
• Check all uses cases

Next Steps

• Support multi-domain logic

[SokratisVidros]

❓ Shouldn't this check go to the resolve_header_token method?

[dimkl]

Since the condition used to execute the resolve_header_token flow is the existence of a header_token and the case described here is that we want to return a signed_out state if it's a cross-origin request and there is no header_token, it will never be triggered in the resolve_header_token flow.

[adentaofftake]

lot of this goes over my head. If it works, I'm excited!

[gkats]

Looks good to me overall, but I admit that the handshake implementation is a bit hard to follow.

Might be just me though.

Great work on a tough problem!