…feature/ig4-authentication] (mlrun#8408)

This PR introduces a new API endpoint to store or update multiple
offline tokens:
`PUT /api/v1/user-secrets/tokens`


For each token in the request, the following validations and operations
are performed:
1. Token Name Validation – Ensure each token has a non-empty and unique
name within the request.
2. JWT Decoding – Decode the offline token and verify it contains the
required claims: sub (user ID) and exp (expiration).
3. User Ownership Validation – Confirm that the sub in the offline token
matches the authenticated user ID
4. Token Verification – Use the Iguazio SDK to validate all tokens via
the `refresh_access_tokens` call. This will be enabled in a separate PR
(mlrun#8443).
5. Secret Storage – (Not implemented in this PR) Creation and updating
of Kubernetes secrets will be handled in a separate PR.

Response Structure – Return lists of token names categorized by action:
created_tokens, updated_tokens, and skipped_tokens.

This functionality has been verified only via unit tests for now

Additional Changes
1. Renamed `api/endpoints/secrets.py` →
`api/endpoints/project_secrets.py`.
2. Extracting the user_id from Orca’s session verification endpoint and
saving it in the AuthInfo

https://iguazio.atlassian.net/browse/ML-10487

…tion] (mlrun#8443)

<!-- A short summary of what this PR does. -->
<!-- Include any relevant context or background information. -->
Implement token verification when storing tokens by using the Iguazio
SDK to validate all tokens via the `refresh_access_token` call.

---

<!-- - Key changes (e.g., added feature X, refactored Y, fixed Z) -->

1. Install iguazio version 0.0.1a9 from Test PyPI.
2. The iguazio package is only supported on Python ≥ 3.11, so run
`test_iguazio_v4.py` only on Python 3.11.
3. Update the test/Dockerfile to install iguazio only when Python ≥
3.11.
4. Import `iguazio` only on Python ≥ 3.11.
5. Initialize the Iguazio client with `auto_login=False` (will not
attempt to login on unauthenticated requests).
6. Implement the `refresh_access_token` method.
7. Catch errors and handle failures by raising an `Unauthorized `error.

---

- [x] I updated the documentation (if applicable)
- [x] I have tested the changes in this PR

---

<!-- - How it was tested (unit tests, manual, integration) -->
<!-- - Any special cases covered. -->
Tested in the system with valid and invalid access tokens, including
tokens that:
- Do not belong to the user.
- Are expired.

---

- Ticket link: https://iguazio.atlassian.net/browse/ML-10814
- Design docs links:
https://iguazio.atlassian.net/wiki/spaces/MLRUN/pages/404521061/BE+Secret+Token+Support+HLD
- External links:
https://iguazio.atlassian.net/wiki/spaces/ARC/pages/361103361/MLRun+Secret+Tokens+in+IG4

---

- [ ] Yes (explain below)
- [x] No

<!-- If yes, describe what needs to be changed downstream: -->

---

<!-- Anything else reviewers should know (follow-up tasks, known issues,
affected areas etc.). -->
<!-- ### 📸 Screenshots / Logs -->

### 📝 Description
<!-- A short summary of what this PR does. -->
<!-- Include any relevant context or background information. -->
This PR introduces support for MLRun authentication with IG4.
It rebases the `feature/ig4-authentication` branch onto `development`

This PR includes the following PRs:

1. #8345
2. #8370
3.  #8366
4. #8388
5. #8440
6. #8408
7. #8466
8. #8471
9. #8443
10. #8484
11. #8498
12. #8574
13. #8529
14. #8584
15. #8588
16. #8589
17. #8567
18. #8623
19. #8612
20. #8514
21. #8626
22. #8632
23. #8633
24. #8667
25. #8668
26. #8674
27. #8780
28. #8754
29. #8796
30. #8811
---

### 🛠️ Changes Made
<!-- - Key changes (e.g., added feature X, refactored Y, fixed Z) -->
To enable IG4 project authorization, set the following configs in mlrun
api:

```
MLRUN_HTTPDB__AUTHENTICATION__MODE: iguazio-v4
MLRUN_HTTPDB__AUTHENTICATION__IGUAZIO__SESSION_VERIFICATION_ENDPOINT: v1/identity/self
MLRUN_IGUAZIO_API_URL: http://igz-api:8000
```

Before importing MLRun, you must set:
```
MLRUN_AUTH_WITH_OAUTH_TOKEN__ENABLED=true
MLRUN_AUTH_TOKEN_ENDPOINT="https://igz-api.<namespace>.<system-domain>/api/v1/refresh-access-token"
```

---

### ✅ Checklist
- [x] I updated the documentation (if applicable)
- [x] I have tested the changes in this PR
- [ ] If I introduced a deprecation:
  - [ ] I followed the [Deprecation Guidelines](./DEPRECATION.md)
  - [ ] I updated the relevant Jira ticket for documentation

---

### 🧪 Testing
<!-- - How it was tested (unit tests, manual, integration) -->  
<!-- - Any special cases covered. -->  
Tested on IG4 system + unit tests

---

### 🔗 References
- Ticket link: https://iguazio.atlassian.net/browse/ML-9683,
https://iguazio.atlassian.net/browse/ML-9870,
https://iguazio.atlassian.net/browse/ML-9998
- Design docs links:
https://iguazio.atlassian.net/wiki/spaces/MLRUN/pages/399179866/Support+IG4+Authentication+in+MLRun+AuthVerifier+HLD,
https://iguazio.atlassian.net/wiki/spaces/MLRUN/pages/411960071/Support+sdk-side+IG4+authentication+-+token+usage+and+management+HLD,
https://iguazio.atlassian.net/wiki/spaces/MLRUN/pages/404521061/BE+Secret+Token+Support+HLD,
- External links:
https://iguazio.atlassian.net/wiki/spaces/ARC/pages/361103361/MLRun+Secret+Tokens+in+IG4

---

### 🚨 Breaking Changes?

- [x] Yes (explain below)
- [] No

Removed unused API endpoints `- POST /api/v1/user-secrets` which was not
in used

---

### 🔍️ Additional Notes


How to enable IG4 authentication -
https://iguazio.atlassian.net/wiki/spaces/PLAT/pages/457671097/Enable+IG4+Authentication+in+MLRun

---------

Co-authored-by: Katerina Molchanova <[email protected]>
Co-authored-by: Amit Elbaz <[email protected]>