Add sync adapter scope for administrative access

[elsand]

Description

This adds a administrative scope akin to Altinn/altinn-events#375 which allows the Dialogporten adapter to read and delete single instances. Delete access is required as this is proxied through the adapter, which will authorize the request from the end-user in Arbeidsflate/SBS.

The implementation adds a check for a partcular scope in StorageAccessHandler, and that the action requested (as defined in the authorization policy is either "read" or "delete").

This will allow for reading (and deletion) of single instances with known ids, even in deleted state, as well as their dataelements, instanceevents, texts etc. Searching for instances is not allowed, as InstancesController.GetInstances implements its own PDP check. This is a deliberate constraint, as the adapter will not need to search for instances (as far as we know). Any PUT or POST request is denied.

Related Issue(s)

• Implement Altinn Platform Storage Integration PoC digdir/dialogporten#1138

Verification

• Your code builds clean without any errors or warnings
• Manual testing done (required)
• Relevant automated test added (if you find this hard, leave it and we'll help out)
• All tests run green

Documentation

• User documentation is updated with a separate linked PR in altinn-studio-docs. (if applicable)

[sonarcloud]

Quality Gate passed

Issues
3 New issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[elsand]

This introduces a new GeneralSetting, InstanceSyncAdapterScope. Unclear to me whether this requires updates to any IAC, or if just having the value in appsettings.json is sufficient.