General

[x] ~Implement authentication endpoint to check and allow/deny requests to Geoserver. TODO add more info!~
- [x] ~Create new app geoserver_authorizer~
- [x] ~Add urls.py on geoserver_authorizer, link it from the root urls.py~
- [x] ~Add single URL entry on urls.py linking to authorize view~
- [x] ~Implement authorize(request) view that extracts the request headers and determines authorization.~
[x] Add new config item on .env holding the Geoserver password, expose it on settings.py as GEOSERVER_PASSWORD
[x] Pass the GEOSERVER_PASSWORD envvar to the Django container

Geoserver

Read-only calls to the WMS services will NOT be authenticated, instead relying on the huge search space of UUID to hide the actual layers.

[x] Review all calls to the Geoserver API, replace the credentials with the exposed GEOSERVER_PASSWORD setting
- models.py: 10 instances of credentials
- views.py: 6 instances of credentials
[x] Ensure that the REST API cannot be called without authentication.
[x] ~Frontend: somehow inject auth info on all Geoserver requests triggered by OpenLayers. Maybe use https://github.com/openlayers/openlaye rs/issues/4213 as guidance (URL fractured to try and avoid this issue appearing in the original issue). TL;DR: specify a "custom tile loader function" where we can set headers as desired, fire off the request, encode the response as Base64 and set it as the img src attribute.~
[x] Configure https://docs.geoserver.org/stable/en/user/security/service.html#anonymous-wfs-access-only-for-read-only-operations to only allow read operations on the API.
[x] Ensure that there is no way to list all layers from WMS.

[x] Add/verify existence of auth info on all requests to NodeODM:
[x] Add proper user verification on all proxied views on https://github.com/IS-AgroSmart/AgroSmart-Web/blob/master/nodeodm_proxy/views.py: extract the auth token, get the user, get the Flight that the UUID refers to, check if the User has rights to access the Flight, return 401 if false, fire off request and pass it along if true.
- task_info and task_output: Allow only if user is Flight owner OR Flight is demo OR user is admin
- cancel_task: Allow only if user is Flight owner OR user is admin
[x] ~Bonus task: on the /nodeodm/uuid/info view, if Flight is Complete, Canceled or Error, don't send subrequest. Instead, respond with data saved in Flight model (this ensures that info will keep working after the Flight gets deleted from NodeODM). Important keys: status.code (obtainable from the Model), processingTime (same), progress.~ Migrated to #123