Create authorization monitor chain elements

[edwarnicke]

This is a followup for after #45.

We will also need authorization chain elements for connection.MonitorNetworkServiceServer and connection.MonitorNetworkServiceClient.

Please put them in the pkg/connection/common subdir (as they are part of the connection API).

[edwarnicke]

Depends on #48

[denis-tingaikin]

@edwarnicke This is looking good to go. Can we schedule this for 1.4.0?

[anastasia-malysheva]

@edwarnicke
This is a proposal on the task, please take a look:

1. Add next chain element for monitor server/client
2. Next authorization politics for servers are proposed:
   2.1. NSC: every client can monitor only it's own connections.
   2.2. Forwarder: every forwarder can monitor only it's own connections to NSE and nsmgr-proxy.
   2.3. nsmgr: every nsmgr can monitor only it's own connections. Other managers can't monitor others managers' connections.
   2.4. nsmgr-proxy: every nsmgr-proxy can monitor only it's own connections.
   2.5. NSE: every NSE can monitor only it's own connections with nsmgr.

[anastasia-malysheva]

@edwarnicke
This is updated proposal on the task, please take a look:

1. Add next chain element for monitor server/client
2. Authorization politic for all servers is: every server can monitor only it's own connections.

[edwarnicke]

@edwarnicke This is updated proposal on the task, please take a look:

1. Add next chain element for monitor server/client

That sounds like the right approach

2. Authorization politic for all servers is: every server can monitor only it's own connections.

That sounds like the right default policy. Do make sure we have an easy way to inject a different OPA policy as well :)