Move auth into middleware

[Porges]

Closes #2098.

This cleans up the authentication a bit; after this change we have two stages in the middleware pipeline:

• AuthenticationMiddleware reads the JWT token (it does not validate it, this is done by the Azure Functions service) and stores it in FunctionContext.Items["ONEFUZZ_USER_INFO"]
• AuthorizationMiddleware checks the user info against the [Authorize] attribute to see if the user has the required permissions
• Functions can read the user info from the FunctionContext if needed

The authorize attribute can be [Authorize(Allow.User)] or Allow.Agent or Allow.Admin. The Admin case is new and allows this to be declaratively specified rather than being checked in code. We have several functions which could be changed to use this (e.g. Pool POST/DELETE/PATCH, Scaleset POST/DELETE/PATCH), but I have only changed one so far (JinjaToScriban).

One of the benefits here is that this simplifies the test code a lot: we can set the desired user info directly onto our (Test)FunctionContext rather than having to supply a fake that pretends to parse the token from the HTTP request. This will also have benefits when running the service locally for testing purposes (refer to internal issue).

The other benefit is the ability to programmatically read the required authentication for each function, which may help with Swagger generation.

[codecov-commenter]

Codecov Report

Merging #3133 (ac8cb9b) into main (b44cff5) will decrease coverage by 0.34%.
The diff coverage is 23.61%.

@@            Coverage Diff             @@
##             main    #3133      +/-   ##
==========================================
- Coverage   29.97%   29.63%   -0.34%     
==========================================
  Files         327      331       +4     
  Lines       38816    38773      -43     
==========================================
- Hits        11634    11492     -142     
- Misses      27182    27281      +99     

Impacted Files	Coverage Δ
...ervice/ApiService/Auth/AuthenticationMiddleware.cs	0.00% <0.00%> (ø)
...Service/ApiService/Auth/AuthorizationMiddleware.cs	0.00% <0.00%> (ø)
...piService/ApiService/Functions/AgentCanSchedule.cs	0.00% <0.00%> (ø)
...c/ApiService/ApiService/Functions/AgentCommands.cs	0.00% <0.00%> (ø)
src/ApiService/ApiService/Functions/Config.cs	0.00% <0.00%> (ø)
.../ApiService/ApiService/Functions/InstanceConfig.cs	0.00% <0.00%> (ø)
src/ApiService/ApiService/Functions/Negotiate.cs	0.00% <0.00%> (ø)
...c/ApiService/ApiService/Functions/NodeAddSshKey.cs	0.00% <0.00%> (ø)
...c/ApiService/ApiService/Functions/Notifications.cs	0.00% <0.00%> (ø)
...iService/ApiService/Functions/NotificationsTest.cs	0.00% <0.00%> (ø)
... and 29 more

... and 3 files with indirect coverage changes

[Porges]

Passes check-pr.

[Porges]

Did some manual validation after check-pr. All looks good.