Add support for an API proxy

Add a second kind of authenticated proxy, that is more appropriate for non-interactive HTTP APIs, where SSO isn't practical. The proxy enforces admin authentication using application-specific passwords.

Enable it for a public_endpoint with the 'enable_api_proxy' option.

docs/reference.md

@@ -2088,6 +2088,12 @@ using single sign-on, allowing access only to administrators (members
 of the *admins* group). This is quite useful for admin web interfaces
 of internal services that do not support SSO integration of their own.
 
+`enable_api_proxy`: If true, place the service behind authentication
+using a mechanism more appropriate for non-interactive APIs (HTTP
+Basic Authentication using Application-Specific Passwords). Only members
+of the *admins* group will have access. When this option is set, you
+also need to specify a unique `auth_service` to be used for ASPs.
+
 #### HTTP (All domains)
 
 `horizontal_endpoints`: List of HTTP endpoints exported by the