Alignment of Integration with IAM BB

[achtsnits]

for initial Q2 delivery we agreed (see https://eoepca.slack.com/archives/C07KHPXA1AP/p1727176651575429) to

• neither protect the adapted workspace-api (v2.0 will just expose bucket and harbor credentials - see Compatibility matrix workspace-api v1<-> workspace components v2 #24 incl. comments - as other functionality provided by different means)
• nor the workspace-ui

and just not expose these endpoints via public ingress, i.e. the endpoints are not protected but only reachable within cluster and at least not publicly

signoff: during Q3 a concept with the IAM BB must be aligned encompassing protection for above endpoints (similar as done with gluu/keycloak in past), still being adaptable/pluggable so that it can be applied to DLR Terrabyte cluster in same manner

[achtsnits]

see https://eoepca.slack.com/archives/C078J079YLR/p1731403162670619 with follow-up item #31

[achtsnits]

following discussion 21.11.2024 with @rconway and the IAM BB team

for 24/Q4

• IAM <-> Workspace integration for initial workspace provisioning #34
• IAM <-> Workspace integration for scoped Workspace-API access #37

for 25/Q1

• TBD IAM <-> Workspace integration allowing owner of workspace to associate additional users #35
• TBD IAM <-> Workspace integration allow a user to select other platform users or groups to access shared data #36