[ws-proxy] close connection if workspace or port stopped share

[iQQBot]

Description

This PR adds a mechanism to disconnect previously unauthenticated connections if the visibility of the workspace or port changes.

Related Issue(s)

Fixes ENT-755

How to test

1. start a workspace
2. execute example stream server
3. make port public
4. try using curl https://workspace-port-url/hello and open this URL in browser (with login)
5. try to make port private
6. you will observe the curl command will disconnection immediately and browser one is still work.

const express = require('express');
const app = express();

const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));

app.get('/hello', async (req, res) => {
    res.write('hello');
    while (true) {
        await sleep(1000);
        res.write('\nhello' + new Date());
    }
})

app.listen(3000, () => {})

Documentation

Preview status

Gitpod was successfully deployed to your preview environment.

• 🏷️ Name - pd-ent-755
• 🔗 URL - pd-ent-755.preview.gitpod-dev.com/workspaces.
• 📚 Documentation - See our internal documentation for information on how to interact with your preview environment.
• 📦 Version - pd-ent-755-gha.29190
• 🗒️ Logs - GCP Logs Explorer

Build Options

Build

• /werft with-werft
  Run the build with werft instead of GHA
• leeway-no-cache
• /werft no-test
  Run Leeway with --dont-test

Publish

• /werft publish-to-npm
• /werft publish-to-jb-marketplace

Installer

• analytics=segment
• with-dedicated-emulation
• workspace-feature-flags
  Add desired feature flags to the end of the line above, space separated

Preview Environment / Integration Tests

• /werft with-local-preview
  If enabled this will build install/preview
• /werft with-preview
• /werft with-large-vm
• /werft with-gce-vm
  If enabled this will create the environment on GCE infra
• /werft preemptible
  Saves cost. Untick this only if you're really sure you need a non-preemtible machine.
• with-integration-tests=all
  Valid options are all, workspace, webapp, ide, jetbrains, vscode, ssh. If enabled, with-preview and with-large-vm will be enabled.
• with-monitoring

/hold

[iQQBot]

we will do authenticate first, if user already authenticated we don't have to add context for this connection.

[filiptronicek]

Works exactly as expected and code looks great. Thank you!