Update TokenVerifier to verify AuthZ too

[creydr]

Updates the TokenVerifier to verify AuthZ too

• providing VerifyRequest() which bundles AuthN and AuthZ checks
• deprecating VerifyJWTFromRequest() which only checks AuthN (switch to VerifyRequest() will be done in mt-broker ingress: Reject unauthorized requests #7980 and InMemoryChannel ingress: Reject unauthorized requests #7981)

[codecov]

Codecov Report

Attention: Patch coverage is 1.53846% with 64 lines in your changes missing coverage. Please review.

Project coverage is 67.76%. Comparing base (96c30bd) to head (80aca3b).
Report is 7 commits behind head on main.

Files	Patch %	Lines
pkg/auth/token_verifier.go	0.00%	64 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #8063      +/-   ##
==========================================
- Coverage   67.92%   67.76%   -0.16%     
==========================================
  Files         366      366              
  Lines       17154    17192      +38     
==========================================
  Hits        11651    11651              
- Misses       4781     4819      +38     
  Partials      722      722              

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[creydr]

@pierDipi could you check on this?

[creydr]

This can be a bit confusing. The webhook is not directly using the EventPolicyLister. But the SinkBinding uses the OIDCTokenProvider from the auth package. In this package we also have the OIDCTokenVerifier, which uses the EventPolicyLister (via eventpolicylister.Get()) and thus registers the informer in its init() method

[creydr]

/test reconciler-tests

[matzew]

is this related?

[creydr]

Before my PR, it was

  - apiGroups:
      - eventing.knative.dev
    resources:
      - eventtypes
    verbs:
      - create
      - get
      - list
      - watch

since we need the same (except for create) for the eventpolicies and they are in the same api group as eventtypes, I merged them and created one dedicated for eventtypes create: -->

  - apiGroups:
      - eventing.knative.dev
    resources:
      - eventtypes
      - eventpolicies
    verbs:
      - get
      - list
      - watch

  - apiGroups:
      - eventing.knative.dev
    resources:
      - eventtypes
    verbs:
      - create

[pierDipi]

/lgtm
/approve

[knative-prow]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: creydr, pierDipi

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [creydr,pierDipi]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment