Extend authentication with external authorization source

• as last (if WMS cascading is descoped) requirement to complete for evolutions?
• more info on the external service endpoint still to be provided by TPZ
• this issue means completely removing shibauth service and configuring traefik forward-auth middleware to this external service & check if we provide enough info to the external service to make the decision (might need splitting of download & rendering requests - split renderer to (downloaded + renderer)