S-48823 WIP: require apiKey for API access

Read config.apiKey from config and match against incoming requests; 403 if no match.