Update HTTP endpoint authorization handler

The default authorization handler for HTTP endpoints is now the AuthenticationBasedHttpEndpointAuthorizationHandler instead of the AllowAnonymousHttpEndpointAuthorizationHandler. The configuration was updated in HttpFeature.cs and the override in Program.cs was removed. This provides more security to HTTP endpoints by requiring authentication.

src/bundles/Elsa.Server.Web/Program.cs

@@ -175,7 +175,6 @@
  .UseHttp(http =>
  {
  http.ConfigureHttpOptions = options => configuration.GetSection("Http").Bind(options);
- http.HttpEndpointAuthorizationHandler = sp => sp.GetRequiredService<AllowAnonymousHttpEndpointAuthorizationHandler>();
  })
  .UseEmail(email => email.ConfigureOptions = options => configuration.GetSection("Smtp").Bind(options))
  .UseAlterations(alterations =>

src/modules/Elsa.Http/Features/HttpFeature.cs

@@ -53,7 +53,7 @@ public HttpFeature(IModule module) : base(module)
  /// <summary>
  /// A delegate that is invoked when authorizing an inbound HTTP request.
  /// </summary>
- public Func<IServiceProvider, IHttpEndpointAuthorizationHandler> HttpEndpointAuthorizationHandler { get; set; } = sp => sp.GetRequiredService<AllowAnonymousHttpEndpointAuthorizationHandler>();
+ public Func<IServiceProvider, IHttpEndpointAuthorizationHandler> HttpEndpointAuthorizationHandler { get; set; } = sp => sp.GetRequiredService<AuthenticationBasedHttpEndpointAuthorizationHandler>();
 
  /// <summary>
  /// A delegate that is invoked when an HTTP workflow faults.