web: introduce authentication (anonymous and OIDC)

[matheuscscp]

Closes: #518

• Manual tests for Anonymous authentication type
• Manual tests for OAuth2 authentication type with OIDC provider and Dex
• e2e tests for RBAC
• Docs

Config is looking like this:

# flux-operator --web-config=/etc/flux-status-page/config.yaml
apiVersion: web.fluxcd.controlplane.io/v1
kind: Config
spec:
  # Optional. Required if .spec.authentication.type is OAuth2.
  baseURL: https://flux-ui.apps.${CLUSTER_DOMAIN}

  # Optional. Sets insecure behaviors, e.g. HTTP cookie 'secure' field to false.
  insecure: false # Defaults to false.

  authentication:
    type: OAuth2 # Anonymous | OAuth2

    # Type-agnostic settings.
    userCacheSize: 200 # Default: 100
    sessionDuration: 24h # Default: one week

    # Type=Anonymous settings.
    anonymous:
      username: some-user
      groups:
        - some-group
        - another-group

    # Type=OAuth2 settings.
    oauth2:
      provider: OIDC # only OIDC is implemented for now. other providers could be Google, GitHub, Microsoft...
      clientID: flux-ui
      clientSecret: flux-ui-secret
      scopes: # Optional.
        - some-scope
        - another-scope

      # OIDC-only
      issuerURL: https://dex.apps.${CLUSTER_DOMAIN} # Required if .provider is OIDC.
      variables:
        - name: username
          expression: "claims.sub"
        - name: domain
          expression: "claims.email.split('@')[1]"
        - name: departments
          expression: "claims.groups.filter(g, g.startsWith('dept:')).map(g, g.substring(5))"
      validations:
        - expression: "variables.domain == 'example.com'"
          message: "email domain not allowed"
      profile:
        name: "variables.name" # Default: "has(claims.name) ? claims.name : (has(claims.email) ? claims.email : '')"
      impersonation:
        username: "variables.username"  # Default: "has(claims.email) ? claims.email : ''"
        groups: "variables.departments" # Default: "has(claims.groups) ? claims.groups : []"

[stefanprodan]

Login view when OIDC auth is configured:

[stefanprodan]

LGTM

Thanks @matheuscscp 🥇