[POC] auth support for paasta APIs

[piax93]

Proof of concept support for an authn/z tween in the PaaSTA API (mostly inspired by previous work).

There's nothing too surprising here. Maybe the only unusual aspect is that I picked to make "dry-run" the default rather then the other way around. It'd make things easier to roll out if this becomes a thing.

I'll draft the client side change soon as well.

---

EDIT:

So, for how the codebase is structured loading the token transparently could be a bit of a pain, especially if we want to maintain a bunch of un-auth endpoints, so I just added the option to set the token header in the API client. From there in the CLI implementation that need auth we can do

from paasta_tools.cli.utils import get_sso_service_auth_token
...
get_paasta_oapi_client(..., get_sso_service_auth_token())