feat(jwt): implement JWT auth for asset downloads

[andrewazores]

Fixes #718
Depends on cryostatio/cryostat-web#319

This PR primarily adds a new POST /api/beta/auth/token API handler. This handler takes the usual Authorization and X-JMX-Authorization headers as well as the resource multipart form attribute and delegates off to the AssetJwtHelper. These three factors are encoded into a JWT, which is then symmetrically encrypted. The handler then responds back to the client with a resourceUrl like http://cryostat.example:1234/api/beta/reports/foo.jfr?token=thetoken. All the client needs to do is then issue a GET http://cryostat.example:1234/api/beta/reports/foo.jfr?token=thetoken and the requested resource will be sent - assuming that by the time this is done the token is still valid, since they expire somewhat quickly. The Authorization header encoded into the token is checked at the time of the GET request to ensure that the user bearing the token has the required permissions for the resource they are requesting, and the X-JMX-Authorization header content encoded into the token is used if needed when establishing any potential JMX connection opened by the request, and the request URL is checked against the original resource attribute to ensure the token was generated for this exact resource. If any of these checks fail then the client receives a 401 response. There are GET /api/beta/recordings/:recordingName, GET /api/beta/targets/:targetId/recordings/:recordingName, GET /api/beta/reports/:recordingName, GET /api/beta/targets/:targetId/reports/:recordingName, and GET /api/beta/targets/:targetId/templates/:templateName/type/:templateType handlers implemented which all accept the JWT rather than requiring Authorization/X-JMX-Authorization headers.

[andrewazores]

This PR is rather large because there's a bunch of new API surface and tests added, but the core of it and the interesting bits are contained in the new AuthTokenPostHandler, AssetJwtHelper, and AbstractJwtConsumingHandler.

@ebaron @hareetd @jan-law any takers for review?

[andrewazores]

Looks like I have some itest cleanup to check on or something.

[andrewazores]

itests are fixed, turned out to be a small and silly issue.

[github-actions]

🎉 Great news! Looks like all the dependencies have been resolved:

• fix(downloads): do not download into browser memory cryostat-web#319

💡 To add or remove a dependency please update this issue/PR description.

Brought to you by Dependent Issues (:robot: ). Happy coding!

[jan-law]

Looks good!