Improve the security of the catalog

[aminelouati]

Actually, the security of the catalog is handled by this property pa.catalog.security.required.sessionid.

When disabled (value =false), then sessionid is not required. In this case, providing good, wrong or empty value gives the same result.

When enabled (value =true), then normally providing a good sessionid has to be required which is not the case for most of the methods. Indeed, checkAccessBySessionIdForBucketAndThrowIfDeclined method asks first about public buckets. So if is false then sessionId is completely neglected.

public void checkAccessBySessionIdForBucketAndThrowIfDeclined(boolean sessionIdRequired, String sessionId,
            String bucketName) {
        if (!isAPublicBucket(bucketName) && sessionIdRequired) {
            checkBucketPermission(sessionId, bucketName);

        }

    }

However, checkAccessBySessionIdForOwnerOrGroupAndThrowIfDeclined seems to be correct.

The overall behavior should be improved which is quite complex (new design). Indeed, using the script referencing from the studio requires that the script is loaded from a public bucket.