Add support for private package repositories

[AbdelHajou]

This PR adds support for adding private package repositories that require Basic authentication. Dependency-Track users can now specify a username and password when adding an internal package repository. The username and password will then be added to the Authorization header for every request to a private package repository.

Repository passwords are encrypted using Alpine's DataEncryption module. After the user has set the password, it will only be decrypted right before making a request to a package repository. Users can not read/edit a repository password, it can only be overwritten.

I've mainly tested this feature using a private Azure Artifacts NuGet repository. While testing, I ran into two other issues:

1. The performVersionCheck tried to retrieve the latest version from NuGet by getting the last element in the versions array. However, Azure Artifacts does not sort this array like NuGet.org does. I changed the method to find the latest version using version comparison.
2. The date format performLastPublishedCheck uses does not match the date format Azure Artifacts returns. I now try parsing the date with multiple formats until the correct format is found.

I was unsure how to add integration tests for this feature, since it requires setting up a private package repository specifically for these tests. Tips on how to automatically test this feature are more than welcome.

Front-end changes are in DependencyTrack/frontend#164

This PR closes #881 and duplicates of this issue:
closes #1321 , closes #1618

Signed-off-by: AbdelH Abdel.Hajou@infosupport.com

[nscuro]

Awesome PR, @AbdelHajou! 🚀

I was unsure how to add integration tests for this feature, since it requires setting up a private package repository specifically for these tests.

You can use MockServer instead, like it's done in https://github.com/DependencyTrack/dependency-track/blob/master/src/test/java/org/dependencytrack/integrations/fortifyssc/FortifySscClientTest.java. It should allow you to test that basic auth headers are sent, but also that NugetMetaAnalyzer behaves as expected when encountering the different timestamp formats.

[AbdelHajou]

@nscuro I added an integration test that tests the authentication, the timestamp parsing and the endpoint discovery