API endpoint for core v1 compatibility not properly protected by auth config

[EricWittmann]

There is a 'legacy' endpoint located at /api/ that is just an alias for the Core V1 API that was moved to /apis/registry/v1. This endpoint should be disabled or protected when enabling auth, but it currently bypasses the auth check.

[EricWittmann]

This is an issue that affected version 2.0.x of registry. However, starting with 2.1.x we have re-written the authentication/authorization layer so that Quarkus policies (configured in application.properties) are no longer used. The new approach is not subject to the above issue.

[EricWittmann]

The workaround for the 2.0.x version is to disable the core v1 legacy endpoint by setting the following ENV variable:

REGISTRY_DISABLE_APIS to have the value /apis/ibmcompat/.*,/api/.*