Amend identification to use linkerd headers

User story

As a user of deploy app,

I want to have the service be robust in the way it resolves identity (authentication),

to avoid any issues with impersonation and security.

Acceptance Criteria

Outline what you think are requirements for this story to be considered Completed.

• Code needs to identify whether the caller is a user or service via provenance

@dataclass(frozen=True)
class ClientIdentity:
    kind: Literal["user", "service"]   # from PROVENANCE (which channel), which is CA-locked
    common_name: str

def resolve_identity(request) -> ClientIdentity | None
    #  l5d present & == trusted ingress (Traefik)  -> user;    cn = X-ClientCert-DN CN
    #  l5d present & != ingress                    -> service; cn = l5d value
    #  l5d absent                                  -> REJECT (fail closed)

• Each integration using python-libpvarki needs to have (in https://github.com/pvarki/opendefence-platform)
  • MTLS_REQUIRE_L5D=true
  • MTLS_TRUSTED_INGRESS_IDENTITIES=traefik.traefik-system.serviceaccount.identity.linkerd.cluster.local

Linked things

Link epics, features and other user stories here, if applicable.
https://pvarki.getoutline.com/doc/rasenmaeher-api-trustidentity-audit-OpE3XR3jBm

Start by locating identity resolution and mTLS configuration in python-libpvarki, then inspect the integrations in opendefence-platform. Use the provided ClientIdentity and resolve_identity requirements as the behavior to verify, and confirm each integration has the two specified environment settings before considering the work done.