Get environment variables of the running application

[Kvanzi]

As an Admin I want to see the environment variables the running backend was started with so that I can verify that a deployment is configured as expected without shell access to the server.

Assumptions & Constraints

1. The values are read from the process environment of the running JVM, so they describe the container the application was started in and change only when it is restarted.
2. Which variables are exposed is decided by configuration, not by the caller: a caller cannot ask for a key that the configuration does not allow.
3. Values are returned as they are, without masking, therefore a variable that holds a secret has to be excluded by configuration rather than hidden at response time.
4. A variable that is set to an empty value and a variable that is not set at all are different states and must not be conflated.
5. The set of variables is small enough to be returned in a single response, so pagination is not needed.

Preconditions

1. Role based access control is in place and an ADMIN role exists.
2. The application is deployed with its configuration supplied through environment variables.

Business rules

1. Only an ADMIN can call this endpoint.
2. Exposure is controlled by an access mode: ALL returns every variable, WHITELIST returns only the explicitly listed keys, BLACKLIST returns every variable except the explicitly listed keys.
3. In WHITELIST mode a key that is not listed is never returned, even when it exists in the environment.
4. In BLACKLIST mode a listed key is never returned, even when it exists in the environment.
5. A configuration that contradicts itself, for example access mode ALL together with a configured key list, is a configuration error and must fail the application startup rather than be silently ignored.
6. Every call is written to the application log together with the id of the admin who made it.

Acceptance Criteria

1. GET /api/v1/admin/environment-variables returns the environment variables of the running application as a JSON object of key to value.
2. A caller without the ADMIN role receives 403 and no data.
3. An unauthenticated caller receives 401.
4. With access mode WHITELIST only the listed keys are returned, and a listed key that is absent from the environment is simply not present in the response.
5. With access mode BLACKLIST every variable except the listed keys is returned.
6. With access mode ALL every variable is returned.
7. Starting the application with access mode ALL together with a configured key list fails with a clear error message.
8. Each call is logged together with the id of the calling admin.
9. The endpoint is not documented in Swagger.

Out of scope

1. Any UI work.
2. Retrieving a single variable by its key.
3. Masking or partially redacting values.
4. Changing, adding or removing environment variables at runtime.
5. Exposing Spring configuration properties: only process environment variables are covered.

Epic link
Epic #<EPIC_NUMBER>

Tasks

1. #<TASK_NUMBER>