basic hardening of externally-facing server

[davepacheco]

Tracking issue for testing (and probably fixing) basic hardening of the external API/console server, like that we close connections that have been open and idle (several cases).

[davepacheco]

There was a fairly detailed description of many areas of hardening in an earlier version of RFD 6:
https://github.com/oxidecomputer/rfd/blob/7e44771b239c0458aea2b6e2045294d41b79cb22/rfd/0006/README.adoc#control-plane-apis

[davepacheco]

Other items I found by going through the TODO-security comments (note: this isn't exhaustive -- I didn't know what to do with all of those)

• rate-limit attempts to try getting a device authn token (

  omicron/nexus/db-model/src/device_auth.rs

  Line 78 in b062e95

  // TODO-security: user code tries should be rate-limited

  )
• rate-limit attempts to login with a password (related to

  omicron/nexus/src/app/silo.rs

  Line 518 in b062e95

  // TODO-security There may still be some vulnerability to timing attack

  )

(edit: these comments were removed under #2417 but the issue remains)

[davepacheco]

See also #2414.

Here are other cases I found in Dropshot:

https://github.com/oxidecomputer/dropshot/blob/406eaf62f1093859771a621de27ab3beeca0247a/dropshot/src/server.rs#L777-L782

https://github.com/oxidecomputer/dropshot/blob/406eaf62f1093859771a621de27ab3beeca0247a/dropshot/tests/test_demo.rs#L13-L14