Authorization capabilities of the API Mediation Layer

Is your feature request related to a problem? Please describe.
As system administrator I want to limit the access to specific services to the specific users. I am used to the SAF tools and want to be able to use them to secure the Web APIs as well.

Describe the solution you'd like
I want every service to respect certain SAF privileges for specific users and reject the access as well as showing the service in the catalog directly based on these privileges.

Describe alternatives you've considered
The usage of Personal Access Tokens limit access to the services when PAT is used, but not in general, the user can still access the services using the other methods.

Additional context
Multiple users are asking for this functionality. There are already four linked issues in our repository:

• https://github.com/zowe/api-layer/issues/706
• https://github.com/zowe/api-layer/issues/1660
• https://github.com/zowe/api-layer/issues/1977
• https://github.com/zowe/api-layer/issues/2984
• https://github.com/zowe/api-layer/issues/2952
• https://github.com/zowe/api-layer/issues/2745
• https://github.com/zowe/api-layer/issues/3207

Asks

• Architecture support in how we should implement the SAF resources and how does it link to the service Ids of the specific service.
• UX in how the fact will be reflected in the Catalog and whether there should be some way to manage the resources directly from the Catalog.