feat(server/auth): validate flipt_client_token cookie in middleware

[GeorgeMac]

Supports #779

Fixes FLI-50

This adds support for passing a Flipt client token via the flipt_client_token key in the Cookie header.
This is necessary to support browser/cookie-based sessions.

The middleware now checks for the presence of either header key Authorization or Cookie.
Depending on which key is present, it parses them appropriately.

One additional change is optional support for skipping auth.
This is done by passing the pointer of the server instance to WithServerSkipsAuthentication(server).
The OIDC server implementation itself requires open access. Since it provides delegated authentication via an Authentication Server.
The authorize URL action simply returns a string which points to the delegated authenticator.
The callback URL must be provided with a valid and verifiable code for auth to be granted.

[codecov-commenter]

Codecov Report

Merging #1139 (3d80114) into main (edc61fb) will increase coverage by 0.27%.
The diff coverage is 100.00%.

@@            Coverage Diff             @@
##             main    #1139      +/-   ##
==========================================
+ Coverage   79.87%   80.15%   +0.27%     
==========================================
  Files          38       38              
  Lines        2758     2796      +38     
==========================================
+ Hits         2203     2241      +38     
  Misses        451      451              
  Partials      104      104              

Impacted Files	Coverage Δ
internal/server/auth/middleware.go	100.00% <100.00%> (ø)

📣 We’re building smart automated test selection to slash your CI/CD build times. Learn more

[markphelps]

is there anyway to identify a server by name instead of doing pointer comparison (when checking for if it's in the o.skippedServers[])?

[GeorgeMac]

I think there might be. We could do a comparison on the string of the full method: https://pkg.go.dev/google.golang.org/grpc#UnaryServerInfo

However, I felt this was relatively more concrete. Since it is direct pointer comparison with the instance we want to skip auth on. We compare with the method name and then someone renames a package or type, and it moves under us.
While this does use any you still have to pass it something and if that something gets renamed it won't compile until you correct it.