document why we mint an x-access-token header

[butonic]

we mint our own token after authenticating the request.
internal services use that token to authenticate requests
reva uses x-access-token for the same thing
we reuse that token, so the reva gateway does not have to reauthenicate using oidc

[phil-davis]

@butonic this is an old issue that was transferred from the archived ocis-proxy repo a few weeks ago.
Please close if no longer relevant.

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed in 10 days if no further activity occurs. Thank you for your contributions.

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed in 10 days if no further activity occurs. Thank you for your contributions.

[butonic]

closing in favor of #4701