Separate API endpoints more strictly/use different varification method

[pfefferle]

The current codebase does not strictly separate the endpoints we need "locally", like for example the endpoints needed by the blocks, from the ActivityPub APIs.

[Update] An alternate solution #1078

This could cause some issues in the future, or at lest bring some more complexity, when it comes to signature verification for example. Request to the ActivityPub endpoints should be verified, local requests might require a session or are open in general.

This is already a problem when you turn on Authorized-Fetch!!!

[github-actions]

This issue could use some more labels, to help prioritize and categorize our work. Could you please add at least a [Type], a [Feature], and a [Pri] label?

[akirk]

In #1078 you show that technically it's not necessary, more of a question of adding the right permisson_callbacks. I don't disagree with separating it out but it might be just more efficient for now to be very dilligent about the callbacks.

[obenland]

A couple of options come to mind for me. We could group Editor related endpoints in a subdirectory of /includes/rest and give them their own namespace. We could also have all endpoint classes extend the same class that has the signature verification as one of its methods, so they all inherit it.

[pfefferle]

I think we can discuss other ways to optimize the structure, but #1078 should fix the issue for now.