feat: implement new interface

[rsmayda]

Description of changes:

verifyAccessToken changes

• Expected fhirUser regex is now a constant FHIR_USER_REGEX
  • fhirUser is expected to be an absolute url
  • If fhirUser claim is not in the right format we reject
• metadata & .well_known changed to pass authorization
• return the userIdentity found by the call to userInfo

authorizeAndFilterReadResponse changes

• For searching filter out resources user does not have access to, does NOT throw error
  • Thought here is if all elements are filtered out the router should call for the next page of search results and try again
• For single reads, throw error if user is not authorized
• For external users (ie their resource is not from our FHIR server) they must use the fully qualified reference to have access
• To check if user is a reference I am converting the JSON to a string then checking for the fhirUser claim
• Internal Practitioners can access anything

isWriteRequestAuthorized changes

• Make this Practitioner only action

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

[nguyen102]

Do we want to pass along the userIdentity in the error message for context?

[rsmayda]

I am hesitant as it may contain PII -- I think better to log/return less

[nguyen102]

Looks good. Some minor comments.