TBD ability to share workspace items with specific users or group

[achtsnits]

goal:

• in the workspace: we need to retrieve a list of users and groups from Keycloak so a team can share workspace items with them. in our understanding Keycloak sets the identity boundary here, so sharing can be still public (with an obfuscated link as now) or restricted to specific users/groups which must exist Keycloak
• the generated url links must be properly authorized (to discuss if this link protection happens in the workspace itself or can be managed externally - like through an auth server/OPA policy at ingress level)
• the workspace service must be properly authorized for Keycloak interaction (to discuss if one client per deployment is best strategy)