Demo of web app with its own WebID

[michielbdejong]

Components:

• user IDP
• app IDP
• app host
• user storage

Steps:

• configure the user storage to distrust all clients except for Solid OS on the same host
• user visits app
• enters their WebID
• the app cannot use the default DPoP mechanism since it's disabled
• the user whitelists the apps's WebID in the ACL of a specific folder
• the app host can now obtain a DPoP token from the app IDP (which does have the app host registered as a client) and access the folder on the user storage
• the app takes care to only show the user's data (retrieved from the user storage) to the logged in user (trusting the user IDP for this)

[michielbdejong]

This might be less work and less controversial than solid-contrib/pivot#64