Contexture security

[K-Dud]

This PR introduces Security module for Contexture API.
There are 2 built in policies

• GetDataPolicy applies to GET /api/* routes
• ModifyDataPolicy applies to all PUT/POST/PATCH/DELETE /api/* routes

And 2 supported authentication schemes

• OIDC when accessing frontend routes authentication scheme is challenged to support user login flow
• Bearer

Example configuration using OIDC scheme

"Security":{
        "Authentication":{
            "OIDC":{
                "Authority": "http://idp/auth/realms/contexture/",
                "ClientId": "contexture-app",
                "ClientSecret": "optional",
                "CookieName": "optional"
              }
        },
        "Authorization": {
            "ModifyData": {
                "RequiredClaims": [
                    {
                        "ClaimType": "contexture-app-role",
                        "AllowedValues": [
                            "modify-data"
                        ]
                    }
                ]
            },
            "GetData": {
                "RequiredClaims": [
                    {
                        "ClaimType": "contexture-app-role",
                        "AllowedValues": [
                            "view-data"
                        ]
                    }
                ]
            }
        }
    }

Example configuration using Bearer scheme

"Security":{
        "Authentication":{
           "Bearer": {
              "IssuerSigningKey": "6e5ee162-d6a0-40cf-a8cc-c4a60f8d2587"
            }
        },
        "Authorization": {
            "ModifyData": {
                "RequiredClaims": [
                    {
                        "ClaimType": "contexture-app-role",
                        "AllowedValues": [
                            "modify-data"
                        ]
                    }
                ]
            },
            "GetData": {
                "RequiredClaims": [
                    {
                        "ClaimType": "contexture-app-role",
                        "AllowedValues": [
                            "view-data"
                        ]
                    }
                ]
            }
        }
    }

When no security configuration is specified the security module is Disabled
When one of policy configurations is omitted the default is to always allow access

TODO:

• consider token validation: validating issuer, audience, signature etc
• consider supporting other built in authorization requirements: RequiresRole, RequiresUserName, RequireAuthenticatedUser
• Update README.md