Update handling of App Pwds

[jeffpaul]

Is your enhancement related to a problem? Please describe.
Following on from #682, we should look to update how Distributor leverages Application Passwords based on feedback from @TimothyBJacobs:

Just wanted to mention that you can check whether the target site supports app passwords by making a request to the REST API Index ( /wp-json ) and looking for application-passwords in the authentication section. See rest_add_application_passwords_to_index for details. That should also be the preferred way to get the URL to redirect the user to instead of hardcoding authorize-application.php.

Describe the solution you'd like

Designs

Describe alternatives you've considered

Additional context

[dinhtungdu]

Note that with the approach above, we can avoid hard-coding application-password.php, but we still need to hard-code admin.php?page=auth_app for bundled Application Passwords.

[jeffpaul]

Also noting that we should look to update our directions on setting up external connections where folks on WordPress X.Y and above do not need the Application Passwords plugin as it's part of WP core: https://github.com/10up/distributor#set-up-external-connections-using-application-passwords

[skorasaurus]

@jeffpaul

Also noting that we should look to update our directions on setting up external connections where folks on WordPress X.Y and above do not need the Application Passwords plugin as it's part of WP core: https://github.com/10up/distributor#set-up-external-connections-using-application-passwords

I made a pull request to address this - #838

[peterwilsoncc]

As work in beginning on Distributor 2.0.0, I've moved this enhancement off the 1.7.0 milestone to allow the point release to focus on bug fixes.

[peterwilsoncc]

In 7f53170 I added the admin_url( 'authorize-application.php' ) as a hardcoded value in the Distributor endpoint. I did this to allow sites to get all the information required by distributor in a single request.

distributor/includes/rest-api.php

Lines 371 to 378 in 7f53170

	function distributor_meta() {
	return array(
	'version' => DT_VERSION,
	'core_has_application_passwords' => true,
	'core_application_passwords_available' => ! wp_is_application_passwords_available() ? false : true,
	'core_application_passwords_endpoint' => admin_url( 'authorize-application.php' ),
	);
	}

This change will account for sites that install WP in a sub-directory but I am wondering if a second HTTP request (or internal request to the REST index) is preferable to account for custom authentication.

To fix this, for now, I'll work of the data added while removing the legacy plugin.