Add header-based authentication support

[banddude]

This PR adds support for header-based authentication, allowing users to authenticate via HTTP headers. This is particularly useful for proxy authentication via SSO providers like Authelia or Authentik.

Features:

• New HeaderAuthentication middleware
• Configurable header names for username and email
• Optional automatic user creation
• Comprehensive test suite
• SQLite and MySQL compatibility

The feature can be enabled via environment variables:

AUTH_HEADER_ENABLED=true
AUTH_HEADER_AUTO_CREATE=true
AUTH_HEADER_USERNAME=X-Auth-Username
AUTH_HEADER_EMAIL=X-Auth-Email

Reverse Proxy Configuration

When using this feature with a reverse proxy, it is important to exclude the /api route from header authentication to prevent issues with API requests. Here is an example Nginx configuration:

location /api {
    proxy_pass http://panel:80;
    # Do not add auth headers for API routes
}

location / {
    proxy_pass http://panel:80;
    # Add auth headers here
    proxy_set_header X-Auth-Username $user;
    proxy_set_header X-Auth-Email $email;
}

This implementation provides a simple way to integrate with existing SSO solutions without requiring complex LDAP, SAML, or OIDC implementations. The proxy handles the authentication, and the panel trusts the headers it receives.

All tests are passing, and the implementation is compatible with both MySQL and SQLite databases.

Fixes #4026

[Zaryu]

You have to exclude the api route from pterodactyl on your reverse proxy, to bypass the api route, otherwise youll get an error with: "Request header to big"

[banddude]

Thanks for the feedback! You are right - I have updated the PR description to include recommended reverse proxy configuration. Users should exclude the /api route from header authentication to prevent issues with API requests.

For example, with Nginx:

location /api {
    proxy_pass http://panel:80;
    # Do not add auth headers for API routes
}

location / {
    proxy_pass http://panel:80;
    # Add auth headers here
    proxy_set_header X-Auth-Username $user;
    proxy_set_header X-Auth-Email $email;
}

This ensures API functionality remains unaffected while still allowing header authentication for the web interface.

[Wouter0100]

Curious to the reasoning on setting hash to false here? I don't think that is part of this feature, and this seems to be the default value according to older Laravel docs:

https://laravel.com/docs/5.8/api-authentication#hashing-tokens

Maybe good to keep removed?