feat(#3517): let a machine authenticate to the authz endpoint with a bearer token

The gateway authenticates scrapers so services do not each grow a static
bearer of their own, but authelia's auth_request endpoint ran its default
strategies, which are cookie-only. A scraper's OAuth2 access token was
refused no matter how it was minted.

CookieSession is listed explicitly because authn_strategies replaces the
defaults rather than extending them. Omitting it evaluates, renders and
starts, and silently ends every operator session on the swarm UI, which
uses this same endpoint.

Unconditional rather than keyed to whichever service is scraped today:
this makes a scheme available, not an authorisation. Authelia refuses a
token carrying no audience for the requested URL and only issues a client
audiences it is registered for, so nothing passes until a client is
registered against a specific URL.

nix/host-modules/swarm-authelia.nix

@@ -1078,6 +1078,35 @@ in
             settings = {
               theme = "dark";
               server.address = "tcp://127.0.0.1:${toString cfg.port}";
+
+              # Let a machine present an OAuth2 access token to the same
+              # `auth_request` endpoint browsers use, so a scraper can be
+              # authenticated by the gateway instead of every service
+              # growing its own static bearer.
+              #
+              # ⚠️ `authn_strategies` REPLACES the defaults rather than
+              # adding to them, so `CookieSession` is listed explicitly.
+              # Dropping it does not fail to evaluate and does not fail to
+              # start — it silently ends every operator session on the
+              # swarm UI, which rides this same endpoint.
+              #
+              # Unconditional, and not keyed to whichever service is
+              # currently scraped: this only makes a *scheme* available.
+              # Authorisation is the audience — authelia refuses a token
+              # that carries no audience for the requested URL, and a
+              # client may only be issued audiences it is registered for.
+              # So enabling the scheme grants nobody anything until a
+              # client is registered for a specific URL.
+              server.endpoints.authz.auth-request = {
+                implementation = "AuthRequest";
+                authn_strategies = [
+                  {
+                    name = "HeaderAuthorization";
+                    schemes = [ "Bearer" ];
+                  }
+                  { name = "CookieSession"; }
+                ];
+              };
               log.level = "info";
 
               # `watch` is load-bearing, not a convenience: authelia reads