Replace basic authentication with credentials authentication provider

[apedroferreira]

We don't have to merge this one as not sure if it's a good idea and apparently the current basic authentication works well on iframes but this one might not work as well? Anyway the idea is here, if we close it it's ok.
We also don't necessarily have to remove the previous basic authentication, these features could coexist...

As has been briefly discussed before, here's how we could replace our current basic authentication feature with using the new authentication features, with a "Credentials" authentication provider that I already had to set up for authentication tests anyway.

Screen.Recording.2024-01-26.at.12.33.27.mov

[Janpot]

As per last grooming meeting:

• to test whether this would break iframe embedded apps like we use in notion

[apedroferreira]

As per last grooming meeting:

• to test whether this would break iframe embedded apps like we use in notion

Looks like that even if I whitelist requests from iframes, which are all being blocked by the auth middleware right now, the CSRF protection doesn't allow the sign-in to work from a different domain. Maybe I could get around it by removing the same-site headers in the cookies Auth.js sets but that's less secure...
So I guess we either ditch this PR or we don't use it as a replacement for the basic auth we already have.

nextauthjs/next-auth#1151