load_stac: support for resources behind auth wall

[pierocampa]

Proposed Process ID: load_stac
Proposed Parameter Name: auth_params
Optional: yes

Context

The clear advantage of getting data from external STAC endpoints to avoid duplication and maintenance of costly catalogues/collections (eg. CDSE's Sentinel collections).

Description

This new param would be necessary to enable data download from external STAC catalogues whose resources/items are behind authentication.

Given the different authentication protocols around, the argument would need to make room
for different types of params, depending on the authentication type (BA usr/pwd, S3 access/secret, etc.)

Data Type

An object with the one mandatory authentication type identifier, plus optional params.

Eg. for the widely used S3 auth type, something like:

• type : "s3"
• access_key : str
• encrypted_secret_key : base64
• encryption_algorithm : str

Additional changes

The private key associated with the public one used to encrypt the secret or other sensitive authentication information shall be registered offline by the user eg. on its openEO user account.

[m-mohr]

That's a difficult one because there are so many authentication types. Ideally, we probably reuse the STAC authentication extension (and/or OpenAPI) here instead of creating our own spec.

Edit: I just saw that @emmanuelmathot proposed the same in the openEO community meeting, sounds good.