(api) Add option to enforce use of scopes (all/read, all/write, etc.) [after #448]

[Leobouloc]

Merge after unification & test refactoring [#448 ]

Purpose

The current state of Ralph allows to restrict users by authority, but does not allow 1. An admin user 2. Finer access control (read, write). This PR aims to solve this issue by implementing scopes (a field already present in user accounts) which can allow restricted access.

Proposal

The scopes proposed are a slight variation on the scopes defined by the xAPI standard:

    "statements/write",
    "statements/read/mine",
    "statements/read",
    "state/write",
    "state/read",
    "define",
    "profile/write",
    "profile/read",
    "all/read",
    "all",

NB: This PR also proposes some cleaning (renaming tests and factorizing code in tests).

TODO:

• restrict endpoint access by scopes
• deal with statements/read/mine scope (ENFORCE_AUTHORITY must be used) (specific test !)
• test restrictions for all endpoints (GET, POST, PUT) AND for both auth methods (OIDC, and basic auth)
• (side quest) rename tests removing extra "statement" (i.e. test_api_statements_get_statements -> test_api_statements_get)
• (side quest) create a mock_statement helper to simplify post and put tests

[wilbrdt]

[wilbrdt]

Wouldn't it be possible to define them with a wildcard? E.g. statements/read/* and */read/*?

[Leobouloc]

I prefered this explicit syntax as it seemed clearer when reading the code, but I can change this.

Anyone else has an opinion ?

[Leobouloc]

Replaced by #463