Implement IIIF Authorization Flow 2.0 in Avalon manifests

[masaball]

Description

IIIF Auth 2.0 has a number of major changes from 1.0 that need to be accounted for:

• Structure has changed from "Access Controlled Resource -> AuthCookieService -> [Probe Service, Token Service, Logout Service]" to "Access Controlled Resource -> Probe Service -> Auth Service -> [Token Service, Logout Service]"
• @context has been moved from the "AuthCookieService" level to the top level manifest @context block
• type names have changed for all services
• profile has been removed from Probe, Token, and Logout service. profile is limited to 'active', 'kiosk', or 'external' in Auth Service. Avalon will probably be using 'active' in all cases.
• 'failureDescription' and 'failureHeader' are now 'errorDescription' and 'errorHeader'. They can now be added for default error responses in the Probe service and the Token service.
• Probe requests are GETs now, so require a JSON response
• Token requests expect an HTML response for both success and failures
• Token response requires entries for @context: "http://iiif.io/api/auth/2/context.json" and type: AuthAccessToken2
• Token error has a lot of options for the response depending on the nature of the error. For initial implementation, hard coding a simple access denied (missingAspect or invalidAspect) will be easiest with a potential followup to handle other errors.

References

• Spec: https://iiif.io/api/auth/2.0/
• Initial WIP: Initial baseline changes for IIIF auth 2.0 #6848

Done Looks Like

• Regular IIIF manifest models are updated to match 2.0 spec
• Playlist IIIF manifest models are updated to match 2.0 spec
• Controllers are updated to respond properly to 2.0 clients:
  • Probe requests are now GETs and expect a JSON response
  • Adjust routing if additional endpoints are needed
• Views are updated to match spec:
  • Auth Token request expects an HTML response for both success and error states
• Re-assess existing auth header and description text in I18n config
• Update automated tests
• Manually test against Auth 2.0 client applications