feat: API Keys

[oxypomme]

API

• Added API Key management
  • Allows for keys scoped to a user (cli, scripts, etc.)
    • Permissions of user are passed to the key
  • Allows for keys scoped to an institution (crons, etc.)
    • Keys are fine grained and user defined
• Added auth flow for API Keys
  • Renamed middlewares (requireJWT -> requireAuth)
  • requireJWT still exists but only checks for JWT / JWE and reject API keys
• Added user permissions api-keys:read and api-keys:write for managing API keys scoped to institution
  • Keys scoped to an institution can't have those permissions
• API Keys can't manage other API Keys

Front

• Added API key management for users
  • Added in the /profile page
  • Merged the /token page with the /profile
  • Added banner to explicit that app tokens (old JWTs) are deprecated

• Added API key management for admins

• Added API key form (admins are asked to specify user OR institution)

• Added API key managements for institution members