(core) add an access token mechanism to help with attachments in custom widgets

Summary:
With this, a custom widget can render an attachment by doing:
```
const tokenInfo = await grist.docApi.getAccessToken({readOnly: true});
const img = document.getElementById('the_image');
const id = record.C[0];  // get an id of an attachment
const src = `${tokenInfo.baseUrl}/attachments/${id}/download?auth=${tokenInfo.token}`;
img.setAttribute('src', src)
```

The access token expires after a few mins, so if a user right-clicks on an image
to save it, they may get access denied unless they refresh the page. A little awkward,
but s3 pre-authorized links behave similarly and it generally isn't a deal-breaker.

Test Plan: added tests

Reviewers: dsagal

Reviewed By: dsagal

Subscribers: dsagal

Differential Revision: https://phab.getgrist.com/D3488

app/gen-server/lib/DocApiForwarder.ts

@@ -7,6 +7,7 @@ import { HomeDBManager } from "app/gen-server/lib/HomeDBManager";
 import { assertAccess, getOrSetDocAuth, getTransitiveHeaders, RequestWithLogin } from 'app/server/lib/Authorizer';
 import { IDocWorkerMap } from "app/server/lib/DocWorkerMap";
 import { expressWrap } from "app/server/lib/expressWrap";
+import { GristServer } from "app/server/lib/GristServer";
 import { getAssignmentId } from "app/server/lib/idUtils";
 
 /**
@@ -25,7 +26,8 @@ import { getAssignmentId } from "app/server/lib/idUtils";
  */
 export class DocApiForwarder {
 
-  constructor(private _docWorkerMap: IDocWorkerMap, private _dbManager: HomeDBManager) {
+  constructor(private _docWorkerMap: IDocWorkerMap, private _dbManager: HomeDBManager,
+              private _gristServer: GristServer) {
   }
 
   public addEndpoints(app: express.Application) {
@@ -61,7 +63,8 @@ export class DocApiForwarder {
   ): Promise<void> {
     let docId: string|null = null;
     if (withDocId) {
-      const docAuth = await getOrSetDocAuth(req as RequestWithLogin, this._dbManager, req.params.docId);
+      const docAuth = await getOrSetDocAuth(req as RequestWithLogin, this._dbManager,
+                                            this._gristServer, req.params.docId);
       if (role) {
         assertAccess(role, docAuth, {allowRemoved: true});
       }

app/gen-server/lib/DocWorkerMap.ts

@@ -137,8 +137,8 @@ class DummyDocWorkerMap implements IDocWorkerMap {
     return null;
   }
 
-  public getRedisClient(): RedisClient {
-    throw new Error("No redis client here");
+  public getRedisClient() {
+    return null;
   }
 }