Switch off spring security on public VS endpoints

[forus]

We are making this change to simplify publishing and unpublishing by using only our custom authorization token, without spring security tokens. The same way the /api/cache call does.

cbioportal/docs/Create-And-Publish-Virtual-Study.md

Lines 26 to 34 in 5c4aab0

	To publish a virtual study, you need to supply the publisher API key in the `X-PUBLISHER-API-KEY` header.
	Here is a curl command to publish a virtual study:
	```shell
	curl \
	-X POST \
	-H 'X-PUBLISHER-API-KEY: <session.endpoint.publisher-api-key>' \
	-v 'http://<cbioportal_host>/api/public_virtual_studies/<virtual_study_id>'
	```

cBioPortal does not have an admin role atm. Having the token makes you an admin.

[pieterlukasse]

Looks good to me 👍
It follows the security pattern of /api/cache, so I understand we're not introducing a new pattern.

[sonarcloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud