Che: Dashboard must not send keycloak token to plugin and devfile registries

[sleshchenko]

Describe the bug

Plugin and Devfile registries are designed as free services that do not require any authentication.
Sending Che Keycloak tokens to them are non-necessary and potentially not a safe thing to do.
Dashboard must not send keycloak token to plugin and devfile registries

Che version

• [ ] latest
• [x] nightly
• [ ] other: please specify

Steps to reproduce

1. Open Development Tools in browser.
2. Open Che Dashboard.
3. Check requests to plugin and devfile registries.

Expected behavior

Keycloak token is not sent to them.

[sunix]

shouldn't it be an option ? if a team is using che in a public cloud and would like to have registry private ?
@slemeur @l0rd

[sunix]

maybe devfile and plugin registry should be secured

[sleshchenko]

@sunix I would distinct two issues here:

1. Che Server token must not be sent to plugin/devfile registries.
2. Add an ability to configure plugin/devfile registries as secure (should we use keycloak token for that or another one - it's implementation details). It may seem easy to solve but if we take into account that users may want to use different registries (some maybe not secured by the same Keycloak as is used for Che Server) and Che Server should be able to access all of them(maybe it should be reworked and client should provide everything downloaded) then it does not seem so easy to solve and IMHO it should be solved separately, if we need it.