feat: per-user permissions when using oauth, follow-up

[michael-pattern]

Description

This is a follow-up to #770

After testing, I found that the original implementation had issues that ultimately made the code change unusable. This is a change set to address those issues.

The original change created login entries with null passwords when the OAUTH_PERMISSIONS env var was enabled, but this presents two issues:

1. If the LOGINS env var is not declared, the app crashes
2. If the LOGINS env var is declared, OAuth cannot be used

In this PR the implementation is changed, instead of creating users from LOGINS, read all entries of LOGIN_PERMISSIONS_x, and directly create userPermissions entries.

Second issue: hasPermission does not work with OAuth, because the authMiddleware method puts the user information in req.user, and not req.auth. To resolve this issue, I have added a narrow change to hasPermission that allows it to check for req.user.login if and only if OAUTH_PERMISSIONS is enabled.

Testing

If you have a dbgate test environment setup, and an oauth provider you can use, this is roughly how you may setup your environment variables to test this change:

export OAUTH_PERMISSIONS="1" # enables the feature
export OAUTH_CLIENT_ID="your-client-id" # must be filled in per your environment
export OAUTH_CLIENT_SECRET="your-client-secret" # must be filled in per your environment
export OAUTH_AUTH="your-auth-endpoint" # must be filled in per your environment
export OAUTH_TOKEN="your-auth-token-endpoint" # must be filled in per your environment
export OAUTH_SCOPE="your-oauth-scope" # must be filled in per your environment
export OAUTH_LOGIN_FIELD="your-login-field" # must be filled in per your environment, it's probably "sub"

## Permissions
export LOGIN_PERMISSIONS_username="~*, widgets/database" # username should be replaced with the expected username

[michael-pattern]

@janproch thank you so much for helping to review and merge my first PR. If you have some time, could I get your assistance with one more PR?

[michael-pattern]

Hi @janproch following up here - Could I get your assistance in having this reviewed and merged? Apologies if you are already aware of this PR

[janproch]

@michael-pattern Thanks for this PR, I have merged it.

OAuth authentication is subject of planned bigger changes in next few months, so probably this will be solved finally in different way.