feat: add API token authentication for REST API access

[cnewkirk]

Summary

• Database-backed API token authentication as an alternative to basic auth for REST API access
• Tokens are SHA-256 hashed at rest, plaintext shown only once at creation
• Configurable expiry with admin-enforced maximum lifetime
• Three access points: REST API (/api/v2/apiTokens), Web UI (self-service + admin), and Karaf shell
• Token auth inherits the user's full role set, matching existing basic auth behavior

Key Components

• features/api-tokens/ — API, impl, and Karaf shell modules
• features/springframework-security/ — ApiTokenAuthenticationFilter (bearer token auth)
• opennms-webapp-rest/ — ApiTokenRestService (JAX-RS REST endpoint)
• opennms-webapp/ — Self-service and admin JSP pages
• core/schema/ — Liquibase changeset for api_tokens table

Security

• SHA-256 hashed storage, one-time plaintext display
• Per-user ReentrantLock prevents TOCTOU race on maxTokensPerUser
• XSS prevention in JSPs (OWASP sanitization)
• Error messages don't leak config values
• Bearer header only (no query parameter support)

Verification

• 17 unit tests (8 service + 9 filter) — all passing
• Full compile and assembly: PASS
• E2E: 21/21 tests passing against container overlay

Test plan

• Basic auth still works
• Token CRUD: create (201), list (200), revoke (204), revoke-all (204)
• Bearer auth: valid → 200, invalid/revoked → 401, malformed → 401, no auth → 401
• lastUsedAt tracking, hash leak prevention, token format validation
• Bad/negative expiry rejected (400), non-existent token (404)
• Admin cross-user operations, revoke isolation