auth-proxy: deploy one shared instance protected all services installed across the env

[giolekva]

Right now every service which requires authentication/authorisation deploys it's own copy of the auth-proxy. To improve resource usage we can deploy single auth-proxy (maybe as a nginx module) and have it query App Store (or config-repo where app configurations are stored) to get per service membership information and enforce it.