Move authorization info from header to body

[gerardsn]

This PR contains the changes needed to make APISIX PEP demo work.

APISIX sends all data of the request as JSON in the body to opa/nuts-pxp, which is different from the headers we opted for in the NGINX PEP flow.

This PR adds a separate API to handle the APISIX requests at /v1/data/apisix. The NGINX flow is unchanged on /v1/data. The body sent by APISIX is of the following format

{
  "input": {
    "var": {
      "server_port": "9080",
      "remote_addr": "172.90.10.2",
      "timestamp": 1718289289,
      "remote_port": "54228",
      "server_addr": "172.90.10.12"
    },
    "type": "http",
    "request": {
      "scheme": "http",
      "method": "POST",
      "host": "pep-right",
      "query": {},
      "path": "/web/external/transfer/notify/21189b43-04d5-4f4f-86ed-e5ae21a87f84",
      "headers": {
        "X-Userinfo": "eyJvcmdhbml6YXRpb25fbmFtZSI6IkxlZnQiLCJzY29wZSI6ImVPdmVyZHJhY2h0LXJlY2VpdmVyIiwic3ViIjoiZGlkOndlYjpub2RlLnJpZ2h0LmxvY2FsOmlhbTpyaWdodCIsImV4cCI6MTcxODI5MDE4NiwiaWF0IjoxNzE4Mjg5Mjg2LCJpc3MiOiJkaWQ6d2ViOm5vZGUucmlnaHQubG9jYWw6aWFtOnJpZ2h0IiwiYWN0aXZlIjp0cnVlLCJjbGllbnRfaWQiOiJkaWQ6d2ViOm5vZGUubGVmdC5sb2NhbDppYW06bGVmdCIsIm9yZ2FuaXphdGlvbl9jaXR5IjoiR3JvZW5sbyJ9",
        "host": "pep-right:9080",
        "authorization": "Bearer TonUNXLwVn2UgJgVfpVDNa7WaXAlE2W-mS6CfqDzeP0",
        "content-length": "0",
        "user-agent": "go-resty/2.13.1 (https://github.com/go-resty/resty)",
        "X-Access-Token": "TonUNXLwVn2UgJgVfpVDNa7WaXAlE2W-mS6CfqDzeP0",
        "accept-encoding": "gzip",
        "content-type": "text/plain; charset=utf-8",
        "connection": "close"
      },
      "port": 9080
    }
  }
}

And APISIX expects a response:

HTTP/1.1 200 OK
Content-Type: application/json

{
  "result": {
    "allow": true
  }
}

---

I have tried to get this work with variable number of path elements after /v1/data as in opa to make it pluggable with a standard opa server, but I cannot get this to work with echo. Using the standard library's http.ServeMux can do this, see #7.

[woutslakhorst]

Maybe it's better to change the current endpoints and the nginx setup?

[woutslakhorst]

So, most of the work to support both use cases would be to adjust logic in this repo and change the nginx case to be compatible?

[woutslakhorst]

Does APISIX always pass the header as b64 encoded. If so, we can be OPA docker image compatible with:

token_climas := json.unmarshal(base64.decode(input.request.headers["x-Userinfo"]))