(WIP) Phantom token v3 updates - DPoP, general improvements and minor breaking changes

[gary-archer]

Some new features, maintenance, minor breaking changes etc for a new major version.

DPoP CHANGES

Support a scheme parameter for API routes, so that DPoP will work something like this:

- name: orders-api
  url: http://example-api:3001
  routes:
  - name: orders-api
    hosts:
    - api.demo.example
    paths:
    - /orders
  plugins:
  - name: phantom-token
    config:
      introspection_endpoint: http://idsvr:8443/oauth/v2/oauth-introspect
      client_id: introspect-client
      client_secret: Password1
      token_cache_seconds: 900
      scheme: DPoP
 - name: dpop-sender-constrained
    config:
       ...

Support opaque access tokens sent from clients like this:

Authorization: DPoP _0XBPWQQ_5557c7ae-f50c-4fd7-a8ae-33ec7dcf3445

I also updated www-authenticate responses to match the scheme, as follows.
I now return the errorand error_description parameter, which is more standard.
Also, we use the more standard invalid_token as the error code, whereas previously we used unauthorized.

WWW-Authenticate DPoP error="invalid_token" error_description="Missing, invalid or expired access token"

I added some tests for the new scheme parameter and made sure all existing tests still pass.

MAINTENANCE CHANGES

• Kong alpine is no longer supported so I switched to Kong Ubuntu 3.9 (latest open source version)
• I updated OpenResty to the latest Ubuntu 24 version - the fat Docker image contains luarocks
• Fixed up standard-credentials-mode in configuration.

CONFIGURATION BEST PRACTICE UPDATES

• It is more appropriate to use access_by_lua_block instead of rewrite_by_lua_block to run before proxy_pass.
• Do configuration validation in the Kong schema or a validate plugin method for OpenResty.
• Use an apply_default_configuration method to set default values.

DOCUMENTATION

• I will update the Wiki and tutorials to explain new behaviors
• I will update this repo to mention the minor (potentially) breaking changes to error responses