feat: Make db-anon-role optional

Without db-anon-role, PostgREST will block any anonymous access without hitting the database.

Resolves #1689, Ref #1823

test/spec/Feature/NoAnonSpec.hs

@@ -0,0 +1,30 @@
+module Feature.NoAnonSpec where
+
+import Network.Wai (Application)
+
+import Network.HTTP.Types
+import Test.Hspec
+import Test.Hspec.Wai
+import Test.Hspec.Wai.JSON
+
+import Protolude  hiding (get)
+import SpecHelper
+
+spec :: SpecWith ((), Application)
+spec = describe "server started without anonymous role" $ do
+  it "behaves normally on attempted auth" $ do
+    -- token body: { "role": "postgrest_test_author" }
+    let auth = authHeaderJWT "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJyb2xlIjoicG9zdGdyZXN0X3Rlc3RfYXV0aG9yIn0.Xod-F15qsGL0WhdOCr2j3DdKuTw9QJERVgoFD3vGaWA"
+    request methodGet "/authors_only"
+        [auth]
+        ""
+      `shouldRespondWith`
+        200
+
+  it "responds with error when user does not attempt auth" $
+    get "/items"
+      `shouldRespondWith`
+        [json|{"message":"Anonymous access is disabled"}|]
+        { matchStatus  = 401
+        , matchHeaders = ["WWW-Authenticate" <:> "Bearer"]
+        }