feat: provide full mutual authentication

[ndr-brt]

What

Implement full mutual authorization

Notes

• using an authorization mechanism is mandatory in order to being able to correlate the control plane id.
• the flow tests have been set with a "test authorization", that's easier than the oauth2 one. The latter has a dedicated test

[ronjaquensel]

One thing that comes to mind is that we now have the Authorization header hardcoded as the auth header used for the control plane. Couldn't potentially other headers be used as well, like e.g. the X-Api-Key one, depending on the setup? Nothing for this PR though, just maybe something we can discuss.

[ndr-brt]

One thing that comes to mind is that we now have the Authorization header hardcoded as the auth header used for the control plane. Couldn't potentially other headers be used as well, like e.g. the X-Api-Key one, depending on the setup? Nothing for this PR though, just maybe something we can discuss.

@ronjaquensel I thought about this, but since jersey spi use MultivaluedMap instead of a simple map it was just easier to pass the Authorization header directly. Let's keep this as a potential refactor for the future, but given that the only authorization profile defined in the spec is the oauth2 one, the implementation should cover the vast majority of the cases