feat: do not store clear api keys in internal storage

[Juiced66]

KUZSUPPORT-68

Goals:

• remove the seed from internal storage in case we have secret provided by config ✔️
  • removed _persistSecret method to use a _initSecret that will load secret at backend start
  • set some changes in TokenRepository init method to detect seed changes and invalidate all tokens
  • refactor validation errors throw order to avoid sending expired if token is invalid && expired (not fully sure it is possible but hey, costs nothing)
  • Warn users at start when using generated seed
  • add authToken config support because jwt is deprecated but authToken is not usable
  • Updated tests to reflect new uses cases.
  • remove test _getSecret wich is not necessary anymore.
  • add documentation warning to encourage use a custom seed when deploying to production using ENV
• do not store clear api keys in internal storage ✔️
  • ensure no breaking changes
  • ensure old api keys still works

review point of interest :

• I decided to remove apikeys from cache at it was stored in clear as in the database. It could be kept using fingerprint as a part of the key instead of api key itself ? May need some refactor

[etrousset]

Kuzzle need to log a big WARNING message when it uses a seed that is stored in ES to informa that it's ok on dev environements, but NEVER on production environement

[Juiced66]

I'll pass it to draft to let time to @rolljee to do manuals test to try finding side effects

[alexandrebouthinon]

Just tested on a local environment with already created API Keys by deleting the doc containing seed and pass it have env variable. Worked like a charm

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud

[kuzzle]

🎉 This PR is included in version 2.34.0-beta.1 🎉

The release is available on:

• npm package (@beta dist-tag)
• GitHub release

Your semantic-release bot 📦🚀

[kuzzle]

🎉 This PR is included in version 2.34.0 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀