feat(api-server): add websocket authorization

[cxntered]

adds authorization for websocket connections with bearer tokens (retrieved from the /auth/:id endpoint) using the ?token query param.
if a client is unauthorized, it closes the connection with status code 1008 (policy violation) with the message "Unauthorized".
not sure if this was the best way to implement authorization, but i am open to suggestions :>

[cxntered]

if security is a concern (we are passing in the token directly in the url after all), passing in the token through the Sec-WebSocket-Protocol header could be an alternative, but i don't know if that's a major concern

[JellyBrick]

@cxntered Your system appears to be affected by the color@5.0.1 vulnerability. We recommend checking your machine. See issue #3855 for details.