Add OAuth to external endpoints

[ruivieira]

Add authentication to external endpoints (Route) for the TrustyAI service.

Each TrustyAI service will now require authentication for both browser and direct HTTP access.
When using from the browser, a login page will be presented (if the user is not already logged in).
When using direct HTTP access, a user token can be used for authentication.

Implementation

The operator now deploys an oauth-proxy sidecar container to each TrustyAI service.
The operator also provides a service account for each oauth-proxy with permissions for tokenreviews and subjectaccessreviews.
The route will now direct traffic to oauth-proxy which authenticate provided user credentials (user tokens for HTTP access).

Example (HTTP)

Assuming a TrustyAI service named trustyai-service in namespace test:

TOKEN=$(oc whoami -t)
curl -v -k https://trustyai-service-test.apps-crc.testing/q/metrics  # access not allowed
curl -v -k -H "Authorization: Bearer ${TOKEN}" https://trustyai-service-test.apps-crc.testing/q/metrics # access allowed

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: tteofili

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

New changes are detected. LGTM label has been removed.

[ruivieira]

/test all

[ruivieira]

/test all