API Authentication Layer

[dbericat]

APIs should authenticate & authorise users before granting access to any API endpoinds.
We should have at least two roles - admin and user.

Users should be able to use read-only APIs (eg Tasks API, Payloads API, Workflow Instances API, etc). Admins should also be allowed to use write/update APIs such as the Workflows API.

• It should be possible to configure an OAuth2 provider URL in the configuration file
• It should be possible to configure the token claim that gives access to Admin APIs, and what claim gives access to the read APIs (mapping external roles/properties to our "admin"/"user" roles).

Note: check with Joe about what to do around test bypass.

[dbericat]

TODO: add security section to requirements