Authenticate Admin API

[bbengfort]

The directory service admin API is not authenticated in anyway and as a result only has one RPC - review, which uses a random token for lightweight authentication. If the directory service was authenticated, it opens up the possibility for more management endpoints and a better DS admin UI.

Preferred authentication: an access/refresh token based scheme on login that works with gRPC; if needed we can also do mTLS authentication, but that is less preferred.

Related:

• emails.go#L73
• models.proto#L75