feat(auth-extension): annotate links with auth:refs if

[alukach]

What I'm changing

Links in STAC responses now receive auth:refs annotations when they point to endpoints protected by a CQL2 filter (items_filter or collections_filter), even when default_public=true. Previously, filter-protected endpoints were advertised as public in link metadata, misleading clients about which requests require authentication.

This PR also renames MatchResult.is_private to MatchResult.uses_auth, which better describes the semantics — an endpoint may be nominally public yet still invoke the auth pipeline because a filter is applied.

How I did it

• Added items_filter_path and collections_filter_path parameters to the shared find_match() utility in utils/requests.py. When a path matches either pattern, find_match now returns MatchResult(uses_auth=True) regardless of default_public.
• Threaded the two filter paths through app.py into AuthenticationExtensionMiddleware, so link annotation uses the same matching logic as the OpenAPI middleware.
• Replaced match.is_private checks with match.uses_auth in AuthenticationExtensionMiddleware and EnforceAuthMiddleware.
• Removed the duplicated _path_has_filter helper from UpdateOpenApiMiddleware; that logic now lives in find_match().
• Added a TestFilterPathAnnotation test class covering: items-filter match, collections-filter match, both filters together, non-matching links, no filters configured, and absolute-URL hrefs.

How you can test it

1. Configure the proxy with default_public=true and set items_filter (and/or collections_filter) to a CQL2 filter generator.
2. Request a collection document, e.g. GET /collections/{id}.
3. Confirm that the items link in the response now includes "auth:refs": ["<your auth scheme name>"], while unprotected links (e.g. self, root) do not.
4. Repeat against the catalog root (GET /) with collections_filter configured and confirm the data link carries auth:refs.
5. Run pytest tests/test_auth_extension.py -k TestFilterPathAnnotation to exercise the new test cases.