Add config option to restrict asset downloads to logged-in users

[Martchus]

This is a draft how restricting access to assets would look like relying on basic auth for the reverse proxy:

• Disallow unauthenticated access to assets in web application routes
• Maintain an htpasswd file for API keys of users to allow requiring authorization for assets in reverse proxies like NGINX
  • Add and remove an entry in htpasswd when an API key is added/removed
  • Store the key as part of the user name as we could otherwise only store one key/secret pair per user (as users are unique)
  • TODO: Is this a security problem? The key is also in plaintext in the database so I suppose it doesn't make things worse.
  • TODO: Handle existing keys and expiration
• Provide API key/secret in Location header when redirecting to reverse proxy; probably not ideal but as it for a download key/secret won't show in the address bar at least
• TODO: Fix other places where assets are downloaded to include API key/secret (e.g. cache service)
• TODO: Submit perl-Apache-Htpasswd to Factory
• See https://progress.opensuse.org/issues/170380