Until now we've used a single fixed API client ID (and key) in our API tests. Now we're adding roles (and want to use various role combinations in tests) we need a more dynamic mechanism.

This introduces a TestAuthenticationHandler similar to what we use in other test projects. There's a singleton CurrentApiClientProvider that's shared by the server and tests that allows setting the current user ID. (It's an AsyncLocal to allow concurrent tests to set their own user independently.)

Given we have two authentication schemes in the API - the API key plus an ID access token - we have to know when our test handler should run vs when it shouldn't (we don't want this TestAuthenticationHandler kicking in when we're testing endpoints that require an ID access token). To do that, I've added a header to the HttpClient used for API key-based calls; the authentication handler looks for that before it runs.