Allow passing the access token in Sec-WebSocket-Protocol header to authorize WebSocket connections

[ghys]

Currently when establishing a WebSocket connection the access token can only be practically passed via the accessToken URI query parameter.
This is generally frowned upon since they might end up in web server/proxies logs. It's not that critical for access tokens because they're short-lived (1h) but it's still not ideal.
Browsers cannot add Authorization headers to WebSocket requests but can specify something to add to the Sec-WebSocket-Protocol header; and some (like Kubernetes) misuse this to send the token.

It might be nice to have that option as well.

More info:
https://stackoverflow.com/a/77060459 (option 5, note that option 6 suggests... switching to SSE)
https://ably.com/blog/websocket-authentication

Your Environment

openHAB 4.3.0.M5