Cache results of group checker

[tomrf1]

The GoogleGroupChecker class makes requests to the Google directory service to find each user's groups.

Currently if the requireGroup Filter is used to check group memberships, a request is made to the Google API every time. I have found that these requests can take ~600ms each time, which can really add up if a webapp needs to make multiple requests, or if the requireGroup Filter is chained.

This PR introduces a cache to the GoogleGroupChecker class to reduce the number of calls to the Google directory. The cache duration is now a class parameter, and defaults to 1 minute.
Note - I've used Google's guava cache here because it's already available in this library.

[davidfurey]

Looks good, but have you tested this with an application in CODE?

[tomrf1]

Looks good, but have you tested this with an application in CODE?

I've tested with an app running locally (using sbt publishLocal), which I think is as good as CODE?

[davidfurey]

Difficult to test with multiple users locally? It would be good to demonstrate that a user logging in with the correct group membership doesn't then cause subsequent requests from a user who is not in the group to be accepted.

I've kicked off a preview release so you can ensure this works as expected in CODE.

[gu-scala-library-release]

@davidfurey has published a preview version of this PR with release workflow run #56, based on commit 6a9d92e:

18.0.0-PREVIEW.tf-cache-groups.2025-01-09T1115.6a9d92ef

Want to make another preview release?

Click 'Run workflow' in the GitHub UI, specifying the tf-cache-groups branch, or use the GitHub CLI command:

gh workflow run release.yml --ref tf-cache-groups

Want to make a full release after this PR is merged?

Click 'Run workflow' in the GitHub UI, leaving the branch as the default, or use the GitHub CLI command:

gh workflow run release.yml

[tomrf1]

Difficult to test with multiple users locally? It would be good to demonstrate that a user logging in with the correct group membership doesn't then cause subsequent requests from a user who is not in the group to be accepted.

I've kicked off a preview release so you can ensure this works as expected in CODE.

Thanks @davidfurey
I've tested in CODE with an internal app.
I was able to view pages, and another person who does not have membership of the necessary groups was not able to. In the logs I can see this:
Excluding [EMAIL ADDRESS] from '/epic-tests' - not in accepted groups: Set([GROUP1], [GROUP2]).

[davidfurey]

Only authed users will end up in the cache, so the unbounded cache size is fine.

[davidfurey]

lgtm