[security] Session based kong authorizer

This is a security enhancement,

We are using a similar Authentification mechanism with our open-source project openware/barong
But after long research we have decided to not expose the JWT and keep it behind the gateway.

We expose to the end-user a session-id or a one-time-token,
This allow to have instant and secure logout, we are also adding at the gateway level ip resolution to invalidate session,
blacklist, or maintenance page.

We would like to contribute a golang or LUA Kong plugin, which would be an optional security hardening.
Merging this would benefit both our companies.

![Supabase-authz](