Query should handle 401 unauthorized exceptions from Katsu gracefully

[OrdiNeu]

Jira link

DIG-1822

Description

While federating servers Daisie found that if you pass in a token that has no authz for anything to the query service, it will pass that on to Katsu and then Katsu will return a 401 Unauthorized. It should return an empty result, instead.

To test

1. Build this branch
2. Go to Keycloak http://candig.docker.internal:8080/auth/admin/master/console/
3. Sign in with your admin username/password
4. Switch realms at the left to candig
   
5. Users->Add User. Fill in username testtest, email test@test.ca
6. Go to the Credentials tab at the top, create new, password testtest
7. Try to sign in at http://candig.docker.internal:5080/ where it'll prompt you to give it a first/last name:
8. Grab a token for this user in the usual manner:

 CURL_OUTPUT=$(curl -s --request POST \                                                                                                                                                                                                                                                                                                                                                       
   --url 'http://candig.docker.internal:8080/auth/realms/candig/protocol/openid-connect/token' \                                                                                                                                                                                                                                                                                              
   --header 'Content-Type: application/x-www-form-urlencoded' \                                                                                                                                                                                                                                                                                                                               
   --data grant_type=password \                                                                                                                                                                                                                                                                                                                                                               
   --data client_id=local_candig \                                                                                                                                                                                                                                                                                                                                                            
   --data client_secret=$CANDIG_CLIENT_SECRET \                                                                                                                                                                                                                                                                                                                                               
   --data username=testtest \                                                                                                                                                                                                                                                                                                                                                                 
   --data password=testtest \                                                                                                                                                                                                                                                                                                                                                                 
   --data scope=openid                                                                                                                                                                                                                                                                                                                                                                        
 )

9. curl candig.docker.internal:5080/query/query -H "Authorization: Bearer $TOKEN"
10. This should now return an empty response instead of an error.

[daisieh]

LGTM, works as expected