* fixesopenziti/ziti#3356 adds www-authenticate headers
- www-authenticate headers are returned on 401s from API requests
- www-authenticate headers are returned during authentication to signal
addtional JWT bearer tokens needed (secondary ext jwt)
- adds support for additional headers on API errors
- adds SecurityTokenCtx for centralized security header processing
(legacy, jwt, etc.)
- adds SecurityCtx for centralized identity, auth policy, MFA handling
- refactors existing JWT authentication methods (oidc, legacy) to use
centralized processing where possible
* fixesopenziti/ziti#2324 add token based enrollment
- allows enrollment to certificate auth
- allows enrollment to ext jwt token auth
- alters ext jwt claimsProperty (maps identity id) to support JSON
pointers, defaults to `/sub`
- adds ext jwt enrollToCert, enrollToToken to controller valid
enrollment end-authenticator state
- adds ext jwt enrollAuthPolicyId to map end identity auth policy to,
defaults to `default`
- adds ext jwt enrollAttributeSelector, supports single field name or
JSON pointer to point to a single string or array of string attributes
to give the identity, defaults to no selector
- adds ext jwt enrollNameSelector, supports single field name or JSON
pointer to a string field to use as the name, defaults to `/sub`
- add enrollment errors to determine if enrollment has occurred
- adds CLI support for ext jwt signer enroll flags
Andrew Martinez