Previously for authenticating a Web API request, users have to sent an access token
provided by Keycloak in HTTP authorization headers. But those tokens are short
lived (usually a couple of minutes) and authentication will fail once they
expired. So to get a new access token without login again, users have to
ask a new one to Keycloak using a refresh token (generated at the same time
than the access one).
So for users that need to make a large amount of authenticated API calls,
they need to implement the token renewal logic from their side
(see [[ https://forge.softwareheritage.org/source/swh-web-client/browse/master/swh/web/client/client.py$178-184 | swh-web-client ]] for instance).
For commodity of use for Web API users, simplify the OIDC authentication worflow
by handling access token renewal directly in the DRF authentication backend.
This means once a user gets it offline refresh token, he can store it and use
it to authenticate all its API calls until the token gets revocated.
To limit the number of requests sent to the authentication provider (Keycloak),
access tokens are put in cache until they expires (usually a couple of minutes).
Related to T1927