SI and IAM integration

Establish what is needed to enable integration between SI and a general OIDC provider, like the Indigo IAM prototype developed by the Purple team. 

Benefit: move away from using the developer flag and integrate with SRC IAM prototype for A&A

Acceptance Criteria:

1. users in an allowed group can authenticate and get/put/delete files in a SI storage site
2. users in a different allowed group can get files but not put/delete

Collaborate with Purple team (dependencies)

 
These components/pieces that need to be deployed or modified to make make SI and IAM work together once the purple team features are available:

1. modify SI services to use plain GMS client instead of CADC's richer internal code
2. build new SI images with updated code to accept/validate IAM tokens (assumption: directly in cadc-util library)
3. SI services need a system credential to make calls to permissions (baldur; assumption: re-use the validated bearer token)
4. SI services need a user credential to call GMS (assumption: re-use the validated bearer token)
5. (probably) some code changes in SI so deployers can use tokens (currently just client certificates)
6. (stretch) luskan could get query permission from baldur rather than be configured directly