Enhancements to API structure, whitelist

[scolapasta]

Rather than blaclist APIS, it'd be nice to have the option to white list. That we we can block all and only allow certain ones. Any newly created API, by default would be blocked.

[pdurbin]

@michbarsinai mentioned post-install-api-block.sh at #976 (comment) but the script never made it into to zip distribution of Dataverse (a release). I know this issue is about enhancements but I thought I'd at least mention it here. @landreev has mostly worked on adding this files to the zip. I'm emphasizing the need to run the script as part of #2884.

[pdurbin]

This is the documentation I added that I was talking about above: http://guides.dataverse.org/en/4.7/installation/config.html#blocking-api-endpoints

[matthew-a-dunlap]

If we go about changing APIs from blacklisting to whitelists, it will be easier to reorganize the file structure of API method endpoints. Specifically, there has been discussion around the inclusion of a number of testing API endpoints being in the Admin api class due to ease of blocking on production machines.

[cmbz]

To focus on the most important features and bugs, we are closing issues created before 2020 (version 5.0) that are not new feature requests with the label 'Type: Feature'.

If you created this issue and you feel the team should revisit this decision, please reopen the issue and leave a comment.