Add support for an API proxy

Add a second kind of authenticated proxy, that is more appropriate for non-interactive HTTP APIs, where SSO isn't practical. The proxy enforces admin authentication using application-specific passwords.

Enable it for a public_endpoint with the 'enable_api_proxy' option.

roles/float-infra-nginx/tasks/api-proxy.yml

 ---
 
 - set_fact:
-    api_proxy_auth_services: "{{ services.values() | selectattr('public_endpoints', 'defined') | map(attribute='public_endpoints') | flatten | selectattr('enable_api_proxy') | map(attribute='auth_service') }}"
+    api_proxy_auth_services: "{{ services.values() | selectattr('public_endpoints', 'defined') | map(attribute='public_endpoints') | flatten | selectattr('enable_api_proxy', 'defined') | selectattr('enable_api_proxy') | map(attribute='auth_service') }}"
 
 - name: Configure api-proxy auth services
   copy: