Add support for "impersonating" users in Ditto

[thjaeckle]

In application development it is often required to e.g. inspect data or a user interface "through the eyes" of a certain user.
E.g. in order for an engineer to be able to get the exact same information shown as a certain user.
For that, it would be great if Ditto could allow certain users to "impersonate" certain other users.

I don't think it makes sense to add this to Ditto policies, but to statically configure this.

First ideas on how to configure and actually perform the "impersonation" follow in this issue.

Configuration

This is a very delicate feature (regarding security) - when wrongly configured or applied, Ditto authorization can be bypassed.
It is therefore important to be able to really strictly configure:

• which auth subjects (users/groups) are allowed to impersonate
• which auth subjects (users/groups) can be impersonated
• for which entities impersonation should work
  • things
  • policies (more delicate, as they control authorization)
  • connections (also delicate, as they could be used to tamper with data or publish data to the outside)
• additional rules for impersonation
  • limiting it to certain namespaces (for things + policies)
  • limiting it to certain permissions (READ / WRITE)
  • e.g. presence of other HTTP headers (to be injected e.g. via infrastructure to provide another "factor" - thinking of MFA)
  • integration with OTP mechanisms?

Do the impersonation

• this has to be possible for all Ditto HTTP / Websocket / SSE APIs
• the APIs have to be usable as they normally would
• that leads to the suggestion to impersonate using HTTP headers
  • e.g.: impersonate-as: "[\"some-idp:some-sub\",\"some-idp:some-group\"]"

[thjaeckle]

Also check existing standards on this, e.g. on OAuth:
https://curity.io/resources/learn/impersonation-flow-approaches/#protocol-standards