Git Token Based Authentication

[Catalin-Stratulat-Ericsson]

This PR adds the ability for the porch server to utilize secrets with tokens (Personal Access Tokens) and use those in authentication with the git instance instead of just basic authentication using username & password in porch repositories.
Documentation Relating to these changes can be found in PR#221

[nephio-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: Catalin-Stratulat-Ericsson
Once this PR has been reviewed and has the lgtm label, please assign johnbelamaric for approval by writing /assign @johnbelamaric in a comment. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[sonarqubecloud]

Quality Gate failed

Failed conditions
32.0% Duplication on New Code (required ≤ 3%)

See analysis details on SonarQube Cloud

[liamfallon]

Suggested change

	//Secret.Data key substring required for the token
	// Secret.Data key substring required for the token

[liamfallon]

Just checking is this OK? Is there nothing to validate?

[Catalin-Stratulat-Ericsson]

see i think this might just be a misworded function name because the basic-auth(username & password resolver & ca bundle resolver both return true for this method also) only the gcw resolver returns the following.

func (b *GcloudWICredential) Valid() bool 
{
	timeLeft := time.Until(b.token.Expiry)
	return timeLeft > 5*time.Minute
}

which to me means that check if the value is still valid based on a time interval/expiry mechanism which i dont believe apply in the other cases?
maybe a different name for the function something like expiryValidity() or something along the lines if my understanding is correct?

[liamfallon]

I think any checks we can do on validity or expiry of the token would be good.

Does the method not have to be called Valid()? I assume this must be an implementation of an interface that is being called by someone?

[Catalin-Stratulat-Ericsson]

in theory yes but this commit only allows the use of git tokens such as personal access tokens which is what we are using since were interacting with git instances for services such as github, gitlab, gitea etc and i believe these type of tokens do not actually include the expiry date in the token itself (just the key which to use) but rather manage this on the server side of the git instance itself.
As such the only way to know if the token is valid(expiry or by the value of the key itself) is to actually attempt to communicate with the git instance itself which is done after this process which simply checks that the secret data given matches what were looking for and is configured in the right way to feed it as an auth to this attempt at communicating with git

[Catalin-Stratulat-Ericsson]

if lets say we added JWT or perhaps other types of tokens to our list and added ability to process them which could contain other data within their token string such as the expiration date etc then another Resolver would have to be created and that Resolver Valid() method could process that information and return a more accurate validity check instead of just returning true