Security hardening from a code audit: several small, self-contained PRs

[Isaries]

Hi, and thanks for maintaining WISE.

I am the new systems operator for NTNU TWISE, a WISE deployment in Taiwan. While getting familiar with the codebase I did a focused review of the authentication and access control code and found a handful of issues. I have opened a small, self-contained pull request for each so they are easy to review or decline individually. All are branched off the latest develop, follow the existing commit conventions, and build on JDK 17. I am happy to rebase, split, combine, or adjust any of them.

Ready for review (small, contained, no behavior change for normal users):

• fix(security): require administrator role for user and account management #322 require the administrator role for user and account management (a researcher could reach user and role management through the broad /admin/** rule)
• fix(security): require authentication for the credential check endpoint #323 require authentication for the credential check endpoint and only return identity fields on a correct password (it allowed harvesting user ids and real names by probing usernames)
• fix(security): throttle failed student password reset answer attempts #324 throttle failed student password reset answers, reusing existing fields so there is no migration (paired with fix(security): show a message when password reset answers are throttled WISE-Client#2325 which shows the new message)
• fix(security): re-check run ownership when batch resetting group passwords #325 re-check run ownership when a teacher batch resets a group's passwords (a teacher could reset another teacher's students' passwords with a crafted group id)

Proposals that change runtime behavior, opened as drafts because they need verification on a running instance:

• fix(security): deny unauthenticated access by default #326 deny unauthenticated requests by default, with an explicit public allowlist
• fix(security): enable CSRF protection for state-changing requests #327 enable CSRF protection

For the two drafts I am happy to provide staging evidence or to narrow the scope. The WebSocket same-origin change is intentionally left out of #327.

No rush at all, and please feel free to close anything that does not fit the project's direction. Thank you for taking a look.

[hirokiterashima]

Thanks so much @Isaries! I will take a look.