Add trusted networks auth provider

[awarecan]

Description:

Need to wait #15914 merged first

Add Trusted Networks Authentication Provider

It shows list of users if access from trusted network. User can select which user want to login, no password need

Breaking change:

Given new auth is enabled, current websocket API will not request auth if access was from trusted networks, After this change, websocket API will always request auth if new auth was enabled.

Any integration leverage on websocket API and trusted_networks together should first get access_token by trusted networks authentication provider, then provide access_token to websocket API.

Related issue (if applicable): fixes #15589

Pull request in home-assistant.github.io with documentation (if applicable): home-assistant/home-assistant.github.io#<home-assistant.github.io PR number goes here>

Example entry for configuration.yaml (if applicable):

# configuration.yaml
homeassistant:
  auth_providers:
    - type: trusted_networks  

Checklist:

• The code change is tested and works locally.
• Local tests pass with tox. Your PR cannot be merged unless tests pass

If user exposed functionality or configuration variables are added/changed:

• Documentation added/updated in home-assistant.github.io

If the code does not interact with devices:

• Tests have been added to verify that the new code works.

[quthla]

Maybe a config setting for trusted networks default user so one can completely skip authentication if wanted?

[awarecan]

@quthla we have discussion about it, please check history of #15589 (comment)

[balloob]

This is not good.

By doing this, we're starting to conflate concerns of the auth provider with the generic abstraction. It means the abstraction is not good and that needs to be changed.

I don't know right now how we should evolve it, maybe we need to decouple the manager from the flow, allowing the manager to pass in an extra auth context.

[balloob]

This also comes with having to decouple the HTTP views from using the helper.

And all these things should happen in separate PRs. One thing at a time.

[awarecan]

Part 3 of #15700 was implement login's own flow manager.

[awarecan]

This included the changes of #15914 , should rebase/merge after #15914 got merged

Two features not included, can be implement in future

1. /auth/providers should only return trusted networks provider option if user access from trusted networks
2. If only one user exist, by pass the user selection step

[balloob]

Rebased.

[balloob]

Beautiful.