feat(key-auth) optionally search the request body for credentials

[p0pr0ck5]

Summary

This commit provides an optional plugin configuration field to
search the request body for the authentication credentials. This
behavior respects the hide_credentials field.

This commit also expands the access test suite to cover a few more
use cases.

Full changelog

• add the key_in_body configuration option
• add related tests
• expand config.hide_credentials tests to cover all use cases (headers, query string, req body)

[thibaultcha]

I think we should apply our codestyle to tests as well

[thibaultcha]

ditto

[p0pr0ck5]

Thanks, minor style fixes applied and merged.

[thibaultcha]

I made a slight oversight: we should have updated the "No API key found in ..." error message returned on HTTP 401, since we now take the body in consideration as well. Maybe even better, we could change it to simply: "No API key provided" or something similar. After all, where else than the headers, the querystring, and the body could once insert an arbitrary value? Not that many places...

[p0pr0ck5]

@thibaultcha would the resulting change in the return values constitute a breaking change, and thus belong in the next major release? or this is something we're comfortable patching now?

[thibaultcha]

I think as long as the HTTP status code doesn't change, this is hardly considered a breaking change. It should be fine.

[p0pr0ck5]

👍 wasn't sure about our stance on the message content itself (i imagine a UI application working based on the contents of the message field). done in #2502.