Add authentication to image factory

[rothgar]

We'll be creating a new instance of the image factory for paying customers with additional features (eg FIPS) that should be only available after a customer has logged in and if they have an entitlement for the product. This may also be used to distribute extensions that are not free or legal for us to distribute (eg portworx).

This authentication will need to be connected to the customer account in stripe so they can use the same login from stripe and can be managed as one customer on the back end.

The image factory should still have unauthenticated options (factory.talos.dev isn't going away) and people will still need to be able to self-host it.

We will need a way for customers to do basic user management (similar to Omni) and for a way to generate programmatic authentication tokens for machines (talos nodes) so they can automatically update and fetch images.

[smira]

HTTP and registry APIs are protected with a username:token pair, each username might have multiple valid tokens.
Credentials are provided to the Image Factory via a static source (e.g. a file).

1. Schematic is owned by the username which created it, and can only be accessed by the same username. Owner is hashed into the schematic ID, so identical schematics owned by different users have different IDs.
2. HTTP APIs: require Basic Auth on image download, schematic creation. PXE endpoint - require basic auth for now, might need to be refined later.
3. Registry API: require registry auth.
4. UI: doesn't need auth up to the moment schematic is created.

Check CDN/S3 storage that it has short-lived credentials.