Add support for HTTPS conn with mTLS and read-only permissions (OpenFGA)

[bmarinov]

A production setup would involve running the collector with minimal (read-only) permissions.

The Incus cert authorization only supports project-scoped permissions - https://linuxcontainers.org/incus/docs/main/authorization/#tls-authorization and is not enough here..

Tasks:

• Set up OpenFGA test env
  • fallback / alternative - scriptlet auth
• Use HTTPS API with client certificates for authentication
• Document FGA permissions needed for the collector (get all instances, get instance, get events)