Introduce auth rotation and session auth support

[robsdedude]

ADR 012: re-authentication

This PR introduces two new auth mechanics for different use-cases

1. Auth Rotation
2. Session Auth (a.k.a. user switching)

Note that all APIs introduced in this PR are previews
See https://github.com/neo4j/neo4j-python-driver/wiki/preview-features

1) Auth Rotation

This is used for auth tokens that is expected to expire (e.g., SSO).

A neo4j.auth_management.AuthManager instance
(or neo4j.auth_management.AsyncAuthManager for async driver) may be passed
to the driver instead of a static auth token.

import neo4j
from neo4j.auth_management import AuthManager


class MyManager(AuthManager):
    ...  # see API dos for details


with neo4j.GraphDatabase.driver(
    "neo4j://example.com:7687", 
    auth=MyManager(),
) as driver:
    ...

The easiest way to get started is using the provided AuthManager
implementation. For example:

import neo4j
from neo4j.auth_management import (
    AuthManagers,
    ExpiringAuth,
)


def auth_provider():
    # some way to getting a token
    sso_token = get_sso_token()
    # assume we know our tokens expire every 60 seconds
    expires_in = 60
    return ExpiringAuth(
        auth=neo4j.bearer_auth(sso_token),
        # Include a little buffer so that we fetch a new token
        # *before* the old one expires
        expires_in=expires_in - 10
    )


with neo4j.GraphDatabase.driver(
    "neo4j://example.com:7687",
    auth=AuthManagers.expiration_based(auth_provider)
) as driver:
    ... 

Note
This API is explicitly not designed for switching users.
In fact, the token returned by each manager must always belong to the same
identity. Switching identities using the AuthManager is undefined behavior.

2) Session Auth

For the purpose of switching users, Sessions can be configured with a static
auth token. This is very similar to impersonation in that all work in the
session will be executed in the security context of the user associated with
the auth token. The major difference is that impersonation does not require or
verify authentication information of the target user, however it requires
the impersonating user to have the permission to impersonate.

Note
This requires Bolt protocol version 5.3 or higher (Neo4j DBMS 5.8+).

import neo4j


with neo4j.GraphDatabase.driver(
    "neo4j://example.com:7687",
    auth=("user1", "password1"),
) as driver:
    with driver.session(database="neo4j") as session:
        ...  # do some work as user1
    with driver.session(database="neo4j",
                        auth=("user2", "password2")) as session:
        ...  # do some work as user2

References

Depends on:

• ADR 012: re-authentication neo4j-drivers/testkit#539

Related PRs:

• Add the ability to Refresh Auth Token Credentials #891

Issues:

• closes [Feature Request] Ability to refresh auth token #834

[AndyHeap-NeoTech]

All looks good, just those experimental tags that needed swapping to preview.