Populate realmconfig on configs response based on user permissions

[AnuradhaSK]

Purpose

This pull request introduces a more secure and robust way to retrieve realm configuration details in the ServerConfigManagementService by adding user authorization checks. Now, only authorized users can view admin user and role information, and sensitive data exposure is minimized. The implementation also introduces helper methods for user authentication and authorization, and updates a dependency version.

Security and Authorization Enhancements

• Refactored the retrieval of RealmConfig in ServerConfigManagementService to use a new getRealmConfig() method, which checks if the authenticated user is authorized to view admin user name and roles before including them in the response. This prevents unauthorized access to sensitive realm configuration details. [1] [2]
• Added helper methods: getAuthenticatedUser() to fetch the user from thread-local properties, and checkUserAuthorization() to verify if the user has the required permissions based on the organization context.

Dependency Updates

• Updated the identity.inbound.oauth2.version in pom.xml from 7.0.302 to 7.0.351 to incorporate the latest fixes and improvements.

Code Maintenance

• Added necessary imports for new classes and utilities used in the authorization logic, such as AuthenticatedUser, IdentityUtil, IdentityOAuth2Exception, and AuthzUtil. [1] [2]
• Introduced a constant AUTHENTICATED_USER for use in thread-local property lookups.

Depends on

• Set authenticated user to thread local wso2-extensions/identity-carbon-auth-rest#335

[sadilchamishka]

Should be unnecessary import