Distributing invalidated tokens between instances is not working in all cases

The APIML collects revoked tokens (if a user calls the logout endpoint) and should distribute them between all instances. It is working well if all services are in good shape, but there are a couple of situations when to distribution is broken.

1. Start 2 instances of GW / ZAAS
2. Log out X on instance A (it is distributed to instance B - correct)
3. Stop instance B
4. Log out Y on instance A (it distribution is not done)
5. Start instance B
6. Instance B should ask instance A for the redistribution of tokens - it is not implemented
7. Stop instance A
8. Token X is invalid, but token Y is valid

There is also a question about the requirement for a certificate for calling the endpoints. It should be allowed only to the APIML certificate, but it looks like the client ones are accepted as well.

Solution A:

• After startup and loading Eureka instances, the GW / ZAAS should ask all other instances for the distribution of all tokens
• The certificate for endpoints (/gateway/api/v1/auth/distribute/** and /gateway/api/v1/auth/invalidate/**) should be restricted only to the APIML cert

Solution B:

• Replace ehCache with Infinispan and remove the code simulating a distributed cache
• It is related to the #4172

This issue was created based on the code review of #4191

Start with the gateway authentication endpoints named in the issue: /gateway/api/v1/auth/distribute/** and /gateway/api/v1/auth/invalidate/**, then review the related code-review issue #4191 and issue #4172. Determine whether the project will pursue startup redistribution and certificate restriction or replace the cache approach; done should cover stopped-instance recovery and the stated certificate boundary.