collaboration fonts management review #3131

Doesn't work out of the box, missing documentation

• The office-settings app is disabled by default (makes sense, since it's only useful in combination with Collabora)
• opencloud-compose, does not enable the app when collabora is enabled, neither does it configure the remote_font_config url required to collabora to download the fonts
• There is no documentation for how to set things up.

New unprotected endpoints at /collaboration/fonts (enabled by default)

The change introduces a couple of new unauthenticated endpoints that are supposed to enable collabora to list and download additional fonts. We're exposing them on the proxy service by default. Which allows anybody to list, download and generate previews of those additional fonts (potential DoS vector)
Technically it shouldn't be need to expose them on the proxy. In our compose deployment collabora and opencloud are running in the same docker network, so collabora would be able to talk the the collaboration service directly for the font listing and download (bypassing the proxy).

The preview endpoint is needed by the office-settings app and should not be unprotected at all, but should require authentication.

The default proxy configuration adds an unprotected endpoint that forwards all requests on /collaboration to the collaboration service, unauthenticated. We should NOT do that.

Other than that, most of what was already written on #3128 is true.