feat(webui / rest api): Add basic HTTP authentication for WebUI + REST API

[Slider0007]

Add Basic HTTP authentication scheme for WebUI and REST API endpoints

⚠️ Security Considerations

• Only basic access authentication scheme using unencrypted HTTP protocol is implemented.
• The basic authentication scheme is not a secure method of user authentication, nor does it in any way protect the entity, which is transmitted in cleartext (only Base64 encoded, not encyrpted or hashed) across the physical network used as the carrier.
• All data (also security related data, e.g. password) are transmitted unencrypted (HTTP only, no HTTPS).
• The access is not only granted to WebUI, but also to any REST API endpoint, because it's protected with same mechanism and linked to same account.

Configuration

The authentication for WebUI and REST API needs to be configured via WebUI: Settings > Configuration > Section 'WebUI' > Authentication or during initial setup procedure (Initial Setup Wizard).

Default Configuration

Authentication disabled (Opt-In feature, not breaking anything; may change in newer releases)

WebUI Security

The authentication process is handled using web browsers default solution (built-in basic authentication popup). After authentication was successful the browser is caching the credentials for the requested domain / realm. As long browsing the same domain / security area, no more authentication is required, cached authentication data is used instead. This cache is usually cleared by e.g. closing the browser.

REST API Endpoint Security

Usage

1. Include Authorization header to REST API endpoint request
   • Header value: Basic concatenated with Base64 encoded USERNAME:PASSWORD, e.g. Basic abcdefghijklnm=
2. http://{USERNAME}:{PASSWORD}@{IP-ADDRESS}/{REST API Endpoint}, e.g. http://username:password@192.168.4.1/info

Endpoint Response

If authorization is enabled and Authorization header is missing or authorization is rejected, system is responding
with status 401 Unauthorized. Check REST API response message to get more details / rejection reason.

---

Further adaptions

• Handle cross-origin access globally (e.g. required for HTML development environment)
• Handle parameter tooltip style globally in param_tooltip.css (style is already used in 3 files)

---

Usage statistics

Before (based on ESP32):
RAM: [= ] 14.3% (used 46972 bytes from 327680 bytes)
Flash: [========= ] 87.9% (used 1710949 bytes from 1945600 bytes)

After:
RAM: [= ] 14.4% (used 47116 bytes from 327680 bytes)
Flash: [========= ] 88.1% (used 1713489 bytes from 1945600 bytes)

---

Authentication implementation is derived/inspired from jomjol#2241. Thanks to @crasu for the template.