API authorization

Highlights:

• every API secured with token-based authentication:
  • GET requests are only accessible to registered users of Arcsi:
    annotated with @auth_token_required
    auth-tokens added into the headers of internal (arcsi view) and external (frontend, app) users
  • POST and DELETE requests are only usable by users with admin roles:
    annotated with @roles_required("admin")
    covered both the cases when we are using them from internal (arcsi view through forms, should be @login_required) or external sources (e.g. postman calls of the CI pipeline, should be @auth_token_required)
• package uplifts:
  • Flask-Login 0.5.0 --> 0.6.0:
    needed for the correct usage of authentication related annotations
  • Werkzeug 0.16.0 --> 1.0.1:
    dependency of the newer Flask-Login version
• authentication-token added to allowed headers in Arcsi's nginx configuration
• Swagger documentation extended with the POST and DELETE requests
• Postman tests uplifted

Thanks @gammaw @molnar-a @pvj @baxgas @tuz666 for this long awaited release ;)