cloud.gov login integration

[akuny]

Changes

• Add integration with cloud.gov identity provider to protect Flask routes that concern application logic
• Authentication dependencies are isolated to a AuthenticationImplementation class
• Add User domain entity, SQLAlchemy model, database migration

Considerations

• No role-based authorization logic yet. Since there are two distinct user roles, each with a distinct set of needs, I was thinking we could build this out simply using a "role" attribute on the User entity
• As a consequence of the point above, users are not assigned a role upon registration at this time
• Having to go through MFA for local development has been not-ideal but there are apparently some workarounds to consider
• We could also use login.gov's sandbox environment as a second oauth provider

[danielnaab]

I'm not sure on current best practices, but you could speed up the container start-up by precompiling the bytecode as the root user. https://kence.org/2022/05/23/python-bytecode-and-read-only-containers/

[danielnaab]

Do we need a separate user name? I might vote for omitting it. Or maybe this is a "display name"?

Also, I think this isn't a problem with the way the function is currently called, but I think the email address should probably be validated here.