feat: require permissions to use debug with modifiable actuator

[pablocarle]

Description

PR XX introduced the possibility of using the actuator /loggers and /gateway endpoints in debug mode. This PR adds restrictions to use it. Normal debug profile allows using them but in view-only mode.

A new debug profile is included to enable them in modifiy mode, but they will require an additional SAF resource on the user.

Also fix the acceptance tests in apiml and gateway-service modules to prioritize the production properties and only override what's needed for tests.

Type of change

• feat: New feature (non-breaking change which adds functionality)

Checklist:

• My code follows the style guidelines of this project
• PR title conforms to commit message guideline ## Commit Message Structure Guideline
• I have commented my code, particularly in hard-to-understand areas. In JS I did provide JSDoc
• I have made corresponding changes to the documentation
• My changes generate no new warnings
• I have added tests that prove my fix is effective or that my feature works
• New and existing unit tests pass locally with my changes
• The java tests in the area I was working on leverage @nested annotations
• Any dependent changes have been merged and published in downstream modules

[taban03]

they can extracted as constants and used in both apiml and gw websecuirty config

[taban03]

is it intentional to require saf resource access for all the requests that are not HEAD and GET?

[pablocarle]

yes, the other ones are all doing some sort of on-the-fly modification of the application

[taban03]

could these rules be combined inside a single authorizeExchange block? something like:

.authorizeExchange(exchanges -> exchanges
    .pathMatchers(HttpMethod.GET, "/application/**").authenticated()
    .pathMatchers(HttpMethod.HEAD, "/application/**").authenticated()
    .anyExchange().access(new SafAuthorizationManager<>(
        safResourceAccessVerifying,
        "ZOWE",
        "APIML.DEBUG",
        "CONTROL"
    ))
)