Protect ASAB API

[byewokko]

• Implemented @asab.web.auth.require_superuser decorator.
• Some ASAB API endpoints now require authorization, while the sensitive ones have been disabled completely.

ASAB API

Core

• /asab/v1/api/config has been disabled.
• /asab/v1/api/environ has been disabled.
• /asab/v1/api/manifest is open.
• /asab/v1/api/changelog is open.

Logs

• /asab/v1/api/log requires asab:service:access authorization.
• /asab/v1/api/logws requires asab:service:access authorization.

OpenAPI and Swagger docs

• /doc is open.
• /asab/v1/openapi is open.
• /oauth2-redirect.html is open.

Metrics

• /asab/v1/api/metrics is open*.
• /asab/v1/api/watch_metrics is open*.
• /asab/v1/api/metrics.json is open*.

*Metrics should be eventually protected (asab:service:access) but that would block Prometheus at the moment. I leave them open until client credentials grant is implemented in Seacat Auth.