337 openid connect

[kjlippold]

Cherry-picked initial OIDC implementation from https://github.com/hydroserver2/hydroserver/tree/337-OIDC for https://github.com/hydroserver2/hydroserver/tree/release/v2.0.0

Discussion items:

1. The following authentication methods are now supported:
   a. session_auth: Django session authentication for use by HydroServer internal frontends.
   b. apikey_auth: API keys associated with service accounts for use by non-user workflows.
   c. basic_auth: Email/password authentication mainly for use in hydroserverpy.
   d. oidc_auth: Token authentication for use by any registered third-party application
2. Internal HydroServer frontend clients will use session_auth, not oidc_auth. Registering internal client such as the data management or QC apps as OIDC clients is possible, but adds more complexity than just supporting both session_auth and oidc_auth.
3. AllAuth headless API has been fully removed. User account and profile management will fully managed through the AllAuth web interface. User profile information will be served to the frontend via views using the same mechanism as other web settings, and to third-party clients via OIDC's userinfo endpoint.
4. Since the headless API has been removed, hydroserverpy now uses basic_auth. Technically, it would be better to use OIDC for hydroserverpy as well, but the user experience is more complex than just entering their username and password. The upside is that users without a password could use hydroserverpy without needing an API key. If we eventually implement this, we should probably remove basic_auth.
5. CORS and CSRF still need to be addressed. CORS should simplify to just allowing read access to HydroServer APIs from anywhere, and CSRF is still needed for session_auth.
6. Updated deployment/dev settings and scripts will be addressed in a separate branch.

[daniel-slaugh]

The approach looks good to me. I think adding your local OIDC test client to the CI pipeline with some additional tests would be helpful. Once CI pipeline is all green, I think this is ready to be merged.