Add Athenz integration module - #6321

Motivation:

This PR aims to provide an integration layer for Athenz so that users can easily obtain Athenz tokens and validate them
by decorating clients or services and annotating required Athenz roles declaratively.

Modifications:

• Client side
  • ZtsBaseClient provides common functionality such as TlsKeyPair management and Athenz client configurations.
    • Users should create ZtsBaseClient first to create AthenzClient and AthenzService.
    • ZtsBaseClient is designed as a resource, and it needs to be closed since Armeria decorators are not closable.
    • The lifecycle of Athenz ClientFactory is delegated to ZtsBaseClient
  • AccessTokenClient acquires OAuth 2.0 token from the/oauth2/token endpoint.
    • The cached tokens are automatically refreshed before expiration.
    • Athenz uses mTLS as the authorization layer, and the client credentials of OAuth 2.0 are unnecessary.
      • This method does not conform to the official OAuth 2.0 specification.
  • RoleTokenClient obtains Athenz role tokens from the /domain/{domainName}/token?role=<roleName> endpoint.
    • It has a similar refreshing logic to AccessTokenClient.
  • AthenzClient is a public decorator that delegates to AccessTokenClient or RoleTokenClient depending on the configuration.
• Server side
  • AthenzPolicyLoader loads Athenz domain policies from ZTS servers, just like the zpu CLI does.
    • The external zpu cronjob to fetch policies is no longer necessary.
    • Both JWS policy data and signed policy data are supported.
  • AthenzPolicyHandler parses the policy data and verifies it with public keys.
  • MinifiedAuthZpeClient is forked from AuthZpeClient and modified to seamlessly integrate with Armeria.
    • MinifiedAuthZpeClient is responsible for token validation.
    • Reviewers may skip a detailed review of this class.
  • AthenzService is a public decorator to check access permission for projected resources.
  • RequiresAthenzRole allows users to specify an Athenz role using annotations.
    • AthenzServiceDecoratorFactory should be injected via DependencyInjector to use RequiresAthenzRole

Result:

• You can now use the Athenz module to easily obtain Athenz tokens and validate them.
• Closes Add Athenz module #6050
• Server example:

class MyService {
  // 1. Decorate the method with `RequiresAthenzRole` to check Athenz role.
  @RequiresAthenzRole(resource = "user", action = "get")
  @ProducesJson
  @Get("/user")
  public CompletableFuture<User> getUser() {
     ...
  }
}

// 2. Create a `ZtsBaseClient` and `AthenzServiceDecoratorFactory` to use Athenz.
ZtsBaseClient ztsBaseClient =
  ZtsBaseClient
    .builder("https://athenz.example.com:4443/zts/v1")
    .keyPair("/var/lib/athenz/service.key.pem", "/var/lib/athenz/service.cert.pem")
    .build();
final AthenzServiceDecoratorFactory athenzDecoratorFactory =
  AthenzServiceDecoratorFactory
    .builder(ztsBaseClient)
    .policyConfig(new AthenzPolicyConfig("my-domain"))
    .build();

// 3. Create a `DependencyInjector` with the `AthenzServiceDecoratorFactory`
//    and set it to the server. `AthenzServiceDecoratorFactory` is required to
//    create the `RequiresAthenzRole` decorator.
final DependencyInjector di =
  DependencyInjector.ofSingletons(athenzDecoratorFactory)
                    .orElse(DependencyInjector.ofReflective());
serverBuilder.dependencyInjector(di, true);

• Client example:

ZtsBaseClient ztsBaseClient =
  ZtsBaseClient
    .builder("https://athenz.example.com:4443/zts/v1")
    .keyPair("/var/lib/athenz/service.key.pem", "/var/lib/athenz/service.cert.pem")
    .build();

WebClient
  .builder()
  .decorator(AthenzClient.newDecorator(ztsBaseClient, "my-domain",
                                       TokenType.ROLE_TOKEN)
  ...
  .build();