Add Apache Shiro based RBAC to razor-server

This adds the JAR files for Apache Shiro, and dependencies, to the project.

It also wires up to initialize a Shiro security manager and ensure it is
available for use across the project.  This is wired to an external
configuration file, pleasantly addressed from our own configuration, and
is the recommended strategy for per-application security management.

It adds a rack middleware to bind the security context around
application execution, and enforces our requirement for successful HTTP
Basic auth over the API space.

It also updates the various API tests to ensure they appropriately
authenticate before invoking web requests, to mirror the new policy.

Signed-off-by: Daniel Pittman <daniel@rimspace.net>
Add example Shiro configuration files

This adds a few Shiro configuration file examples, showing how various
authentication sources can be configured inside the application -- completely
transparently to Razor.

Signed-off-by: Daniel Pittman <daniel@rimspace.net>
Make authentication optional, disabled if not specified

This makes the authentication implementation a little more compatible with
previous deployments: unless you turn on authentication, it is disabled and
there are no restrictions to accessing the `/api` URL space.

When enabled this enforces the same rules as before: you must have valid
credentials to be able to access the namespace at all.

Signed-off-by: Daniel Pittman <daniel@rimspace.net>
Implement command RBAC security checks

This adds the infrastructure to support permission checks for users, and ties
in all the commands to them.  This is the simplest version: it restricts based
on the command and the target object name.

Signed-off-by: Daniel Pittman <daniel@rimspace.net>
Implement query RBAC security checks

Signed-off-by: Daniel Pittman <daniel@rimspace.net>