Replace enabling of unauthenticaed access to badges via admin config
checkbox with an api authentication with a new dedicated permission
"VIEW_BADGES".

Signed-off-by: Kirill.Sybin <kirill.sybin@lex-com.net>

Signed-off-by: Kirill.Sybin <kirill.sybin@lex-com.net>

Signed-off-by: Kirill.Sybin <kirill.sybin@lex-com.net>

Add new badge permission to tests. Remove tests for badge disabling. Add
tests testing authentication, permission and ACL access.

Signed-off-by: Kirill.Sybin <kirill.sybin@lex-com.net>

Signed-off-by: Kirill.Sybin <kirill.sybin@lex-com.net>

Allows API authentication via URI query param for badge requests as an
alternative to header authentication because typical use cases for
badges do not easily allow header injection.

Requires stevespringett/Alpine#641

Signed-off-by: Kirill.Sybin <kirill.sybin@lex-com.net>

Update tests to focus on API authentication via URI query parameter, but
keep some tests that test header authentication as that remains an
option.

Requires  stevespringett/Alpine#641

Signed-off-by: Kirill.Sybin <kirill.sybin@lex-com.net>

Add a default team for viewing badges for new DBs.

Signed-off-by: Kirill.Sybin <kirill.sybin@lex-com.net>

To make the removal of unauthenticated access to badges not be a
breaking change after all, the enable badges config property is kept in
after all, but repurposed into a setting to enable unauthenticated
access to the badges resource. If it is disabled, then the badges api
remains accessible to authenticated and authorized requests.

Signed-off-by: Kirill.Sybin <kirill.sybin@lex-com.net>

Signed-off-by: Kirill.Sybin <kirill.sybin@lex-com.net>

Update documentation for globally configurable unauthenticated access to
badges.

Signed-off-by: Kirill.Sybin <kirill.sybin@lex-com.net>

Signed-off-by: Kirill.Sybin <kirill.sybin@lex-com.net>