[GWT-IDE] Don't touch Keycloak under Che7 environment.

[monaka]

On multi-user/multi-host Che7 environments, the URL of IDE is differ from the URL of wsmaster.

So, on copying Keycloak object, web browsers throw DOMException as the cross site scripting.

In addition, Keycloak can't respond requests for getting new token.
Because the URL of IDE is not listed in redirect_url.

What does this PR do?

Pass the token (generated by Keycloak) to the IDE in <iframe> via postMessage()

What issues does this PR fix or reference?

#12585

[che-bot]

Can one of the admins verify this patch?

[che-bot]

Can one of the admins verify this patch?

[che-bot]

Can one of the admins verify this patch?

[skabashnyuk]

@monaka. Thank you for your efforts.

I think that the approach you've selected has some disadvantages that we should avoid.
Such kind of messaging with dashboard allow someone to create a plugin that will allow
to take away keycloak token in such way.

• Start workspace with the malicious plugin.
• Share a link with such code on some forums/emails/sites
• Users who are authorized on Che dashboard may open some forums/emails/sites
• User's browser load pages with the malicious plugin and communicate with the dashboard.
• Malicious plugin send the keycloak token to third-party sites

In my opinion, the correct approach would be to teach GWT IDE to work without a keycloak token.

[monaka]

@skabashnyuk Agree. After some trys and errors, I got how the JWT proxy works and what is the better approach. I'm going to fix this on my forked repository.

[monaka]

Close as I open #13142 (will fix the same issue as this).