REST API - Enable RBAC

[swaroopar]

• [x] Add 3 roles to eclipse-xpanse project on Zitadel - admin, user, csp
• [x] Add authorization required on API - at class level or at method level
• [x] Validate the 'token' claims contains the list of roles allocated to user under claim name urn:zitadel:iam:org:project:roles - https://zitadel.com/docs/apis/openidoauth/claims
• [x] Proceed only when the required role is available in the list of role the user has in the claim urn:zitadel:iam:org:project:roles.
• [x] If role is allowed to user, then return 403 error.
• [x] Ensure the role based authorization is executed only when zitadel profile is enabled.
• [x] If no role is received in the claims, then assume user roles.

Note - we might have to use the customizer for extracting roles - https://docs.spring.io/spring-security/reference/reactive/oauth2/resource-server/opaque-token.html#webflux-oauth2resourceserver-opaque-authorization-extraction

[baixinsui]

I will take it.