Add authentication mechanism to secure contour

[surajssd]

Right now we don't have way to secure ingress and apps it is serving, unless apps are providing an authentication mechanism of their own. So for apps that don't support any form of authentication are wide open.

After implementing this feature ingress controller can act as a guard for such applications.

[invidian]

Couple of notes:

• perhaps this should be done not on the contour level but on ingress object level
• Perhaps oauth2_proxy could be used for this: https://kubernetes.github.io/ingress-nginx/examples/auth/oauth-external-auth/. However, it might not be possible with Contour because of Provide support for integrating with an external auth service. projectcontour/contour#432 ? On the other hand, oauth2_proxy does not support basic auth either.
• In Kyma project, Istio is used to guard endpoints and it supports all kind of authentication. However, I don't know how it integrates with ingress controller then.

[jpeach]

Contour 1.9 supports Envoy external authorization servers (see https://projectcontour.io/guides/external-authorization/); for an out-of-box OIDC integration https://github.com/istio-ecosystem/authservice could be a match.

[surajssd]

Thanks for those pointer @jpeach 👍