Add `AllRequiredFactorsAuthorizationManager.anyOf`

[rwinch]

In order to support something like webauthn OR (password and OTT) and get the correct AuthorizationResult when access is denied, we should create a built in way to perform a logical or on AllRequiredFactorsAuthorizationManager instances that is smart enough to combine the FactorAuthorizationDecision into a meaningful response. Something like this comes to mind

        public AuthorizationResult authorize(Supplier<? extends @Nullable Authentication> authentication, T object) {
            List<RequiredFactorError> factorErrors = new ArrayList<>();
            for (AllRequiredFactorsAuthorizationManager<T> factor : this.factors) {
                FactorAuthorizationDecision result = factor.authorize(authentication, object);
                if (result.isGranted()) {
                    return result;
                }
                factorErrors.addAll(result.getFactorErrors());
            }
            return new FactorAuthorizationDecision(factorErrors);
        }

Since it is bound to AllRequiredFactorsAuthorizationManager would likely be available as public <T> static AuthorizationManager<T> anyOf(AllRequiredFactorsAuthorizationManager<T>... managers)

NOTE: AuthorizationManagers.anyOf is not sufficient because it does not know how to combine the results properly. Nor should it be updated to be aware of ``FactorAuthorizationDecision.

[evgeniycheban]

Hi @rwinch, can I work on this one?

[ziqin]

I like AnyFactorAuthorizationManager. It is expressive because theoretically any combinatorial boolean expression can be normalized as sum of products (though we don’t support negation here in AnyFactorAuthorizationManager).

To make it more robust, we may need to consider deduplicating factor errors.

Say we want to express “any 2 of Password, OTT, X509” using AnyFactorAuthorizationManager. The sum-of-products would be “(Password ∧ OTT) ∨ (Password ∧ X509) ∨ (OTT ∧ X509)”.
Suppose the user is authenticating with only its password, if each error is simply appended to the list, the final factorErrors list we get would be [OTT, X509, OTT, X509], which may not be what we want.

[rwinch]

@evgeniycheban Yes please work on this. Please see @ziqin comment which is valid