[Feature]: Add Opaque Token Policy

[DDH13]

Please select the area the issue is related to

Area/Policies (Policies, Policy Hub, Policy Engine etc)

Please select the aspect the issue is related to

Aspect/API (API backends, definitions, contracts, interfaces, OpenAPI)

Description

Requirements

Similar to jwt-auth create a policy that allows validation using opaque-tokens

[DDH13]

wso2/gateway-controllers#210

[DDH13]

Required Clarifications

1. Whether to remove claimMappings feature from the policy
   claimMappings: "aud": "header-aud"
   Allows the user to map a claim into the request header similar to Kong

2. Whether required scopes validation for an API should be AND or OR validation
   Currently in jwt-auth as well, if all the specified required scopes in an API are not present, then it is considered an authentication failure. In the APIM if at least one scope is present then the users is allowed to access the resource

3. What is the best way to support multiple identity providers?
   Currently when a token is received we check with all configured provider introspection endpoints until one returns true

[DDH13]

Regarding the above

1. Remove it
2. Used an OR validation
3. Added a tokenPattern attribute to the provider. If the regex matches, then that issuer is selected. If no tokenPattern is specified, the token is checked against all providers.

[DDH13]

Adhered to the defined standards
https://datatracker.ietf.org/doc/html/rfc7662

[DDH13]

Used the hashed(token+issuer) as a cache key. More cache entries than usual will be created if tokenPattern is not configured per issuer properly