Add support for an API proxy

Add a second kind of authenticated proxy, that is more appropriate for non-interactive HTTP APIs, where SSO isn't practical. The proxy enforces admin authentication using application-specific passwords.

Enable it for a public_endpoint with the 'enable_api_proxy' option.

roles/float-infra-nginx/tasks/api-proxy.yml

+---
+
+- set_fact:
+    api_proxy_auth_services: "{{ services.values() | selectattr('public_endpoints', 'defined') | map(attribute='public_endpoints') | flatten | selectattr('enable_api_proxy', 'defined') | selectattr('enable_api_proxy') | map(attribute='auth_service') }}"
+
+- name: Configure api-proxy auth services
+  copy:
+    dest: "/etc/auth-server/services.d/api-proxy.yml"
+    content: |
+      {% for s in api_proxy_auth_services %}
+      {{ s }}:
+        backends:
+          - backend: file
+            params:
+              src: users.yml
+              static_groups: [admins]
+        enforce_2fa: true
+        rate_limits:
+          - ip_ratelimit
+          - failed_login_blacklist
+          - anti_bruteforce_blacklist
+      {% endfor %}
+  when: "api_proxy_auth_services"
+