Introduce STS client grants API and OPA policy integration (#6168)

This PR introduces two new features

- AWS STS compatible STS API named AssumeRoleWithClientGrants

```
POST /?Action=AssumeRoleWithClientGrants&Token=<jwt>
```

This API endpoint returns temporary access credentials, access
tokens signature types supported by this API

  - RSA keys
  - ECDSA keys

Fetches the required public key from the JWKS endpoints, provides
them as rsa or ecdsa public keys.

- External policy engine support, in this case OPA policy engine

- Credentials are stored on disks

pkg/policy/policy.go

@@ -27,12 +27,12 @@ const DefaultVersion = "2012-10-17"
 
 // Args - arguments to policy to check whether it is allowed
 type Args struct {
-	AccountName     string
-	Action          Action
-	BucketName      string
-	ConditionValues map[string][]string
-	IsOwner         bool
-	ObjectName      string
+	AccountName     string              `json:"account"`
+	Action          Action              `json:"action"`
+	BucketName      string              `json:"bucket"`
+	ConditionValues map[string][]string `json:"conditions"`
+	IsOwner         bool                `json:"owner"`
+	ObjectName      string              `json:"object"`
 }
 
 // Policy - bucket policy.