feat: add Authorization to the Management API

[paullatzelsperger]

What this PR changes/adds

Adds an AuthorizationService interface, which allows controllers to check whether a user (identified by a Principal) is allowed
to have access to a particular resource (identified by ID and its type).

Controllers can inject a SecurityContext, and from it obtain the Principal.

As a precondition, the respective extension must register a lookup function for any particular resource type.

Why it does that

User authorization

Further notes

• Endpoints which require elevated access (@RolesAllowed) are not subjected to authorization
• I did not yet put any major focus on extensibility, that could come in a subsequent improvement pr

Linked Issue(s)

Closes #216
Closes #219

Please be sure to take a look at the contributing guidelines and our etiquette for pull requests.