Dynamically reduce the scope of a requested WoT Thing Description in Ditto to the user's permissions

[thjaeckle]

Currently, any authenticated (not authorized - this is currently not checked) user may fetch the WoT "Thing Description" of a Thing which links to a WoT Thing Model in its definition field.

This is done providing the accept header: Accept: application/td+json (content negotiation).
However:

• as said, any authenticated user may fetch the TD of any known thingId
• and the user gets back the complete functionality of the thing - which may be much more than the user is able to see or use from the thing's API

So the idea of this issue is to scope the generated TD based on the user's permissions:

• only include the WoT "properties" which the user is able to READ
• dynamically generate "readOnly" based on the permissions
• only add "actions" which the user is allowed to invoke (WRITE to)