Add full api restriction setting (#15656)

[uber-dendy]

SUMMARY

This PR introduces a new configuration option, RESTRICT_API_ANONYMOUS_ACCESS, to enhance security by allowing administrators to restrict unauthorized access to all AWX API endpoints, with the exception of those specified in ANONYMOUS_ACCESS_API_ALLOWED_PATHS. This feature is especially important for environments with strict security policies that require more control over which endpoints can be accessed without authentication. By default, this feature is disabled to ensure backward compatibility with existing setups.

This is related to #15656, but more flexible

Proposal:

• Add a new setting RESTRICT_API_ANONYMOUS_ACCESS to enable or disable the restriction of anonymous access to the API.
• Introduce ANONYMOUS_ACCESS_API_ALLOWED_PATHS to define which paths can be accessed without authentication.
• Modify the middleware to enforce these restrictions, returning a 401 Unauthorized response for any unauthorized API access attempts.

ISSUE TYPE

• New or Enhanced Feature

COMPONENT NAME

• API

ADDITIONAL INFORMATION

• The feature ensures that current installations remain unaffected by default, and administrators can opt-in based on their security needs.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[djyasin]

Hi @uber-dendy thank you for taking the time to contribute! After reviewing your PR, we think this functionality would be better suited to Django Ansible Base. You can contribute to that repository here:
https://github.com/ansible/django-ansible-base/pulls

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[djyasin]

Hello @uber-dendy, thank you again for your contribution. After further discussion of this PR, we have determined that this is not an appropriate implementation at this time. Thank you again for your time!