Update AuthorizationFactory interface

[tylerwowen]

Update AuthorizationFactory interface to make it more secure.

The issues

Wrong method invoked during on-the-fly authorization

TeletraanAuthorizer<TeletraanPrincipal> authorizer = authorizationFactory.create(context);

When CompositeAuthorizationFactory is configured, this always returns the BasePastisAuthorizer. It is a problem because ScriptTokenPrincipal can only be authorized by ScriptTokenRoleAuthorizer, otherwise illegal access is possible. It was prevented before the introduction of on-the-fly authorization via bundling the authenticator and the authorizer in the auth filter creation.

AuthorizationFactory interface

The interface of AuthorizationFactory makes it possible get wrong authorizer.

<P extends TeletraanPrincipal> TeletraanAuthorizer<P> create(TeletraanServiceContext context)
            throws Exception;

Fixes

Dissociate TeletraanAuthorizer and Authorizer interfaces.

TeletraanAuthorizer stops extending Authorizer. All authorizers implementing TeletraanAuthorizer now need to implement TeletraanAuthorizer and Authorizer respectively.

New method in AuthorizationFactory

The existing methods are updated to return Authorizer.

<P extends TeletraanPrincipal> Authorizer<P> create(TeletraanServiceContext context);

Introduced a new method to return TeletraanAuthorizer.

Call new method in EnvCapacities

authorizationFactory.createSecondaryAuthorizer(
                        context, teletraanPrincipal.getClass());

And it's the only option now, no way to be mistaken.