expose new build-in swagger api UI

[6543]

e.g. https://ci.woodpecker-ci.org/swagger/index.html

• link from normal WebUI to it Link swagger in navbar #1984
• redirect <rootURL>/swagger/* to it
• server flag to disable swaggerUI Allow to disable swagger #2093

[lonix1]

Also

• a setting to disable swagger ui (e.g. in production)
• custom path to hide ui from prying eyes (e.g. woodpecker.example.com/foo/bar/swagger)

[6543]

hide it would not make a difference as api is public documented anyway - we are a opensource project and follow good security practices 😆 (not security by obscurity) ... anyway disable it is a valid suggestion

[lonix1]

Agreed.

_{I didn't mean "security by obscurity", because you still need to authenticate to be able to use it anyway. But many apps allow you to run it on a different path, so only company staff knows about it, which avoids bots finding it and hammering your APIs. They discover the API endpoints through swagger.}

Personally, I am just going to disable it in production. It's an unnecessary risk once the server is tested and working.

[anbraten]

added apart from the redirect (which seems to be not really necessary).