ASAP Client Authentication Extension

[jamesmoessis]

I have raised this PR as my branch was messed up in #6233 and needed to start on a fresh one

Description:
Adding an extension which allows the collector to authenticate outgoing requests with ASAP (Atlassian Service Authentication Protocol).

It works by implementing ClientAuthenticator and setting the authorization header as the encoded JWT. It uses the go-asap library to achieve much of its functionality.

Link to tracking Issue:
#5930

Testing:
We mock key server and a base RoundTripper to achieve validation on signature and fields on the JWT. Configuration and factory are also tested. There are yaml files for good and bad config (one good, multiple bad configurations).

Additionally, at Atlassian we have been using ASAP in the collector for a long time already.

Documentation:

README.md gives a sample configuration and brief description. Those familiar with ASAP should have little trouble setting it up

Additionally, @MovieStoreGuy and myself are happy to be the codeowners for this extension.

[jamesmoessis]

@jpkrohling I have addressed your comments from the old PR:

• Stopped exporting the test keys: https://github.com/open-telemetry/opentelemetry-collector-contrib/pull/6627/files#diff-26329fa71d37aaccefb8d751db31961a6b44e1625b522e634635c596d670fd2fR29
• The extension in the correct alphabetical place in the CODEOWNERS file now: https://github.com/open-telemetry/opentelemetry-collector-contrib/pull/6627/files#diff-3d36a1bf06148bc6ba1ce2ed3d19de32ea708d955fed212c0d27c536f0bd4da7R54
• Renamed validateAsapJwt -> validateAsapJWT: https://github.com/open-telemetry/opentelemetry-collector-contrib/pull/6627/files#diff-bf18964287c64418cc38db676767d169c6ca2523c96a78f7db1e89f7dcb17790R72
• Build is now green

You also asked

For my own education, do you have a resource with the differences between it and OAuth 2?

I don't know of a page that exactly outlines what you're asking, but I can explain some key differences here. Some differences:

• Asap is purely for service-to-service.
• In Asap the client self issues its tokens. The server verifies the token using a public key obtained from a keyserver.
• Asap does not concern itself with authorisation. Its "primary goal is to allow the resource server to be confident that an incoming request comes from an authentic, identifiable client." (from the spec)

Sorry about the old PR getting corrupted! Let me know if there's anything else I can do to improve the PR 🙂

[jpkrohling]

LGTM. A small comment about the name of the comment and the data type for TTL. Nothing serious, and can be merged as it is if you don't think those changes are desired.