Draft: Generate a low-privilege, ephemeral `CI_JOB_TOKEN`

What does this MR do and why?

This update implements the ability to authorize requests based on the permissions encoded within a JWT token. It introduces an internal API for generating and issuing these tokens, which carry the necessary permissions directly within the token itself. Requests are then authorized by validating the token and using the permissions embedded in it.

For further details on the design and rationale behind this implementation, please refer to the Design Proposal for Low-Privilege CI Job Tokens.

MR acceptance checklist

Please evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Screenshots or screen recordings

How to set up and validate locally