Authorization / authentication: tools for public endpoints

At this moment, QuickWit does not offer authentication / authorization. This keeps the project focused, but it also forces the user to deal with this. This often means adding a reverse proxy and rolling your own authentication. Maybe there's a simple solution to this, but I'm not aware of it. If there is such a thing, it might make sense to add it in the docs, and perhaps in the helm charts. I'm currently trying to get oauth2-proxy working, might be a decent option.

I think it would be even better if users could create API keys with some settings (e.g. Scoped to a index, write vs read etc) and add these bearer tokens in http headers for authentication. I'm pretty happy with how Meilisearch did this. Basically: pass an env for a master key, which in turn can create new api keys with narrow scopes.

Start by comparing the proposed oauth2-proxy approach with the API-key design described in the issue, including master-key configuration, scoped read/write access, and bearer tokens. Review how these options could relate to the Helm charts and public endpoints. Done means the project has an agreed authentication direction and a clearly bounded implementation or documentation plan.