feat: anonymous sign-ins

[kangmingtay]

What kind of change does this PR introduce?

• Implements Anonymous Sign-in  #68
• An anonymous user is defined as a user that doesn't have an email or phone in the auth.users table. This is tracked by using a generated column called auth.users.is_anonymous
• When an anonymous user signs-in, the JWT payload will contain an is_anonymous claim which can be used in RLS policies as mentioned in Option 3.

{
  ...
  "is_anonymous": true
}

• Allows anonymous sign-ins if GOTRUE_EXTERNAL_ANONYMOUS_USERS_ENABLED is enabled
• Anonymous sign-ins are rate limited on a per hourly basis and controlled by GOTRUE_RATE_LIMIT_ANONYMOUS_USERS. This is an ip-based rate limit.
• You can also configure silent captcha / turnstile to prevent abuse
• There are 2 ways to upgrade an anonymous user to a permanent user:
  1. Link an email / phone identity to an anonymous user PUT /user
  2. Link an oauth identity using GET /user/identities/authorize?provider=xxx

Example

# Sign in as an anonymous user
curl -X POST 'http://localhost:9999/signup' \
-H 'Content-Type: application/json' \
-d '{}'

# Upgrade an anonymous user to a permanent user with an email identity
curl -X PUT 'http://localhost:9999/user' \
-H 'Content-Type: application/json' \
-H 'Authorization: Bearer <access_token_of_anonymous_user>' \
-d '{"email": "[email protected]"}'

# Upgrade an anonymous to a permanent user with an oauth identity
curl -X GET 'http://localhost:9999/user/identities/authorize?provider=google' \
-H 'Authorization: Bearer <access_token_of_anonymous_user>

Follow-ups

• Cleanup logic for anonymous users will be made in a separate PR

[hf]

Looks good! Left some readability and error code nits that generally don't have a major impact on the feature.