Add capability API controller, refactor test code

[vreff]

This PR adds a capability API web controller that can be used to make calls to the capabilities on the node directly. It is useful for E2E tests.

The PR also does some refactoring on test code:

• Removes use of hardcoded paths for local CRE
• Exports useful Vault DON test helpers to their own file
• Adds external target registration to framework/DONs
• Fixes a syntax error in writer_don_load_test.go and workflow_don_load_test.go

All of which makes it easier to test 3rd party capabilities on CRE.

[cedric-cordenier]

Can we keep this private unless there's some reason for it to be public? (I don't see anything in this PR but I may have missed it)

[vreff]

Will result in downstream duplication as we use this in our E2E test, DM'ing. If you prefer it stay private, that's fine, just some duplicate code.

[cedric-cordenier]

Ah no then it's OK 👍

[cedric-cordenier]

Hmmm... the implementation of RequiresRunRole is suspicious:

// RequiresRunRole extracts the user object from the context, and asserts the user's role is at least
// 'run'
func RequiresRunRole(handler func(*gin.Context)) func(*gin.Context) {
	return func(c *gin.Context) {
		user, ok := GetAuthenticatedUser(c)
		if !ok {
			c.Abort()
			jsonAPIError(c, http.StatusUnauthorized, errors.New("not a valid session"))
			return
		}
		if user.Role == clsessions.UserRoleView {
			c.Abort()
			jsonAPIError(c, http.StatusUnauthorized, errors.New("Unauthorized"))
			return
		}
		handler(c)
	}
}

Looks like any view role user can execute this, probably a long-standing bug that we would fix.

I'm not sure we would want to enable this endpoint in production builds -- can we use build.IsDev() or similar and only register it if that's true?

[vreff]

Done: 8e811fd.

[cl-sonarqube-production]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube