guestlinks: proxy middleware to validate guestlink cookies for authentication

[rhafer]

• Extract JWT from cookie
• Validate JWT (lifetime, signature, ...)
• Lookup share validate ttl
• (Do we need to check if target resource is in scope here?, How's that handle for "normal" user shares)
• Sign reva token for usertype guest, userid == mailaddress, (set scope if needed)
• What about user-roles? Do magic-link user require a user-role?
• Return status codes as outlined here: Discuss/Define authentication mechansim for "magiclinks" #2517 (comment)