Runtime configuration for HTTP permissions, policy, form authentication mechanism and realm

[michalvavrik]

closes #19162 but mainly this is preparation for #16728

This moves as much from auth config to runtime, as possible. I believe flags that enables auth mechanisms can't be moved as we need to determine which beans to create at build time. OpenAPI document that requires security provider information is also build during build time.

[michalvavrik]

Hey @sberyozkin ,

I opened PR because I need arguments for additions I plan to suggest for @LookupIfProperty, however if you find a time for early feedback, it will be well appreciated.

[sberyozkin]

Thanks @michalvavrik will try to have a look asap

[michalvavrik]

It's nice that CI is green, but that's only because we never use @Inject for auth mechanisms. We can suppress beans from programmatic lookup, but they still exists.

@sberyozkin I'm afraid we will always need to have build time configuration properties that enables form/basic/mTLS auth mechanism as ArC won't allow as to create beans conditionally based on runtime value (or remove them when some condition won't match).

I'll rewrite this tomorrow, let's don't waste your time on this, thanks!

[michalvavrik]

looks like #31903 brought in conflicts, I am also working on permissions related stuff that will break the PR, so I'll rebase it once it is done.

[michalvavrik]

This might need different approach.