Add JWT Bearer Authentication support and tutorial

tutorials/http/jwt-auth/README.md

@@ -0,0 +1,62 @@
+# JWT Bearer Authentication
+
+## Build and run:
+
+```sh
+make
+```
+
+## HS256:
+
+This path signs and verifies JWTs with the shared secret from `main.c`.
+
+```sh
+curl -i http://127.0.0.1:8000/login-hs256
+TOKEN=$(curl -s http://127.0.0.1:8000/login-hs256 | sed -n 's/.*"token":"\([^"]*\)".*/\1/p')
+curl -i -H "Authorization: Bearer $TOKEN" http://127.0.0.1:8000/
+```
+
+```txt
+HTTP/1.1 200 OK
+Content-Type: application/json
+Content-Length: 47         
+
+{"sub":"admin","scope":"dash:read dash:write"}
+```
+
+`scope` here is a JSON string value containing a space-delimited permission list; as an example.
+
+## ES256 (Requires MG_TLS_BUILTIN):
+
+This path parses the EC private key from `main.c`, signs the JWT with it, and
+derives the public key for verification to keep the example self-contained.
+
+```sh
+curl -i http://127.0.0.1:8000/login-es256
+TOKEN=$(curl -s http://127.0.0.1:8000/login-es256 | sed -n 's/.*"token":"\([^"]*\)".*/\1/p')
+curl -i -H "Authorization: Bearer $TOKEN" http://127.0.0.1:8000/
+```
+
+```txt
+HTTP/1.1 200 OK
+Content-Type: application/json
+Content-Length: 36         
+
+{"sub":"admin","scope":"dash:read"}
+```
+
+`scope` here is a JSON string value containing a space-delimited permission list; as an example.
+
+## Unauthorized access attempt example
+
+```sh
+curl -i -H "Authorization: Bearer bad.token.here" http://127.0.0.1:8000/
+```
+
+```txt
+HTTP/1.1 401 Unauthorized
+WWW-Authenticate: Bearer
+Content-Length: 13         
+
+Unauthorized
+```