Integrate permissions with catalog-backend refresh endpoint (#8693)

Integration permission framework with refresh in catalog-backend

... through the use of a new AuthorizedRefreshService.

Signed-off-by: Joon Park <joonp@spotify.com>

.changeset/plenty-eyes-brush.md

@@ -0,0 +1,60 @@
+---
+'@backstage/create-app': patch
+---
+
+Add permissions to create-app's PluginEnvironment
+
+`CatalogEnvironment` now has a `permissions` field, which means that a permission client must now be provided as part of `PluginEnvironment`. To apply these changes to an existing app, add the following to the `makeCreateEnv` function in `packages/backend/src/index.ts`:
+
+```diff
+  // packages/backend/src/index.ts
+
++ import { ServerPermissionClient } from '@backstage/plugin-permission-node';
+
+  function makeCreateEnv(config: Config) {
+    ...
++   const permissions = ServerPerimssionClient.fromConfig(config, {
++     discovery,
++     tokenManager,
++   });
+
+    root.info(`Created UrlReader ${reader}`);
+
+    return (plugin: string): PluginEnvironment => {
+      ...
+      return {
+        logger,
+        cache,
+        database,
+        config,
+        reader,
+        discovery,
+        tokenManager,
+        scheduler,
++       permissions,
+      };
+    }
+  }
+```
+
+And add a permissions field to the `PluginEnvironment` type in `packages/backend/src/types.ts`:
+
+```diff
+  // packages/backend/src/types.ts
+
++ import { PermissionAuthorizer } from '@backstage/plugin-permission-common';
+
+  export type PluginEnvironment = {
+    ...
++   permissions: PermissionAuthorizer;
+  };
+```
+
+[`@backstage/plugin-permission-common`](https://www.npmjs.com/package/@backstage/plugin-permission-common) and [`@backstage/plugin-permission-node`](https://www.npmjs.com/package/@backstage/plugin-permission-node) will need to be installed as dependencies:
+
+```diff
+  // packages/backend/package.json
+
++   "@backstage/plugin-permission-common": "...",
++   "@backstage/plugin-permission-node": "...",
+```

.changeset/three-sheep-sparkle.md

@@ -0,0 +1,7 @@
+---
+'@backstage/plugin-catalog-backend': minor
+---
+
+In order to integrate the permissions system with the refresh endpoint in catalog-backend, a new AuthorizedRefreshService was created as a thin wrapper around the existing refresh service which performs authorization and handles the case when authorization is denied. In order to instantiate AuthorizedRefreshService, a permission client is required, which was added as a new field to `CatalogEnvironment`.
+
+The new `permissions` field in `CatalogEnvironment` should already receive the permission client from the `PluginEnvrionment`, so there should be no changes required to the catalog backend setup. See [the create-app changelog](https://github.com/backstage/backstage/blob/master/packages/create-app/CHANGELOG.md) for more details.