Implement OpenID token expressions evaluation

[ErmakovDmitriy]

This PR implements an OpenID token expression evaluation.

The idea and the use-case is to be able to define different behavior in HAProxy based on OpenID token claims.

An example:

• An OpenID token contains a field roles which is an array of admin, viewer, editor;
• We want to allow access to /admin URL path only for people with admin role;

With this PR, it is possible to define in HAProxy:

acl host1.example.com hdr(host) -i host1.example.com
acl host1.example.com_admin_path path_beg -i /admin
acl host1.example.com-admin-allowed var(sess.auth.token_expression_in_roles_admin) -m bool

http-request send-spoe-group spoe-auth try-auth-all if host1.example.com
http-request set-var(req.oidc_token_expressions) str("in;roles;admin") if host1.example.com
http-request send-spoe-group spoe-auth try-auth-all if host1.example.com

use_backend haproxy-spoe-auth-error if host1.example.com oauth2_error
use_backend haproxy-spoe-auth-redirect if host1.example.com !oauth2_authenticated

http-request deny deny_status 403 if host1.example.com !host1.example.com-admin-allowed host1.example.com_admin_path oauth2_authenticated
use_backend host1.example.com-backend if host1.example.com host1.example.com-admin-allowed

[mougams]

Thank you for the PR, a bit complex since this adds lots of things in the same PR - would have been nice if this could be split, but that's ok.

I've put few remarks, and the patch seems breaking.
Also, you might need to rebase, since I've merged some lib updates.

[mougams]

This could probably be removed since never used

[ErmakovDmitriy]

I think that NewStaticOIDCClientStore is used here https://github.com/ErmakovDmitriy/haproxy-spoe-auth/blob/83168273b5dfb93155e124958989b14f471e7ce6/cmd/haproxy-spoe-auth/main.go#L141
and NewEmptyStaticOIDCClientStore is used in a test: https://github.com/ErmakovDmitriy/haproxy-spoe-auth/blob/83168273b5dfb93155e124958989b14f471e7ce6/internal/auth/oidc_clients_store_test.go#L12

[mougams]

To simplify, you could probably merge this with the constants

	operationIn           string = "in"
	operationNotIn        string = "notin"
	operationExists       string = "exists"
	operationDoesNotExist string = "doesnotexist"
)```

so that during the assignement it becomes as simple as

		expr.Operation = val[0].value

[ErmakovDmitriy]

I am sorry, I might have misunderstood your idea but I can not see how I can simplify this.

May I ask you to explain me?

[ErmakovDmitriy]

Hi mougams,

Thank you and sorry for such a complex PR.

I will try to fix what you requested and update this PR.