IndexerMetricsCollector checks for authorization

[gobengo]

POST /events shouldn't let just anyone submit an event. It should check for proof of authorization.

For v0 just allow configuring one or more shared secrets that can be used as http basic authorization.

Followup work can add support for zcaps.

AC

• [x] check for authz on POST /events
• [x] check for authz on GET /metrics

[gobengo]

use basic auth instead

base64(user:pass)

[gobengo]

Added. This is configured by the CLIENTS environment variable documented here

The current value for prod is in team secret manager 'metrics-collector production CLIENTS'