Group membership check

[chkeita]

This PR enables the restriction of certain api to some user based on their principalid or their group membership

Api Restriction rules

We provide the ability to create a set of rules that specify which group has access to an api
The set of rules is a list of RuleDefinition defined set in the property api_access_rules of the Instance configuration

  [
      {
          "methods": ["get", "post"],
          "endpoint": ["/api/jobs"],
          "allowed_groups": ["<group_id>"]
      }
  ]

We store and manage in the RequestAccess class defined in #1420

Rules enforcement

Those rules are enforced when the request is received by the service.
A call to check_access determine if the request is authorized or not.

Group membership information retrieval

The group membership is retrieved from azure call to msgraph in the AzureADGroupMembership class
This call requires specific permissions which depending on the environmentt can only be granted by an admin.
We also provide for testing purposes a StaticGroupMembership class to provide the access restriction functionality without querying azure.
The class is initialized with the group membership information stored in the Instance configuration in the field group_membership

Testing

A functional test is provided in api_restriction_test.py