Authenticate Mosaic FS

[DavieReid]

When in active mode, a running instance of Mosaic is made available via a fastify webserver. All requests are unauthenticated including admin APIs.

We need to integrate authentication for:

1. All Admin APIs,
2. Workflows API
3. Content API, though this could be configurable to allow for public access

There is a fastify plugin for passport.js which looks promising and could be combined with a strategy that uses OAuth OIDC --> https://www.passportjs.org/packages/passport-openidconnect/