chore: make authz recorder opt in (#20310)

The authz recorder is causing a lot of memory to be allocated, and is a
memory leak for websocket connections.

This change makes it opt-in on a per request basis (ontop of `isDev`).
To get the authz headers, use `Copy as cURL` on chrome and append the
header `x-authz-checks=true`.

coderd/httpmw/authz.go

@@ -4,6 +4,7 @@ package httpmw
 
 import (
 	"net/http"
+	"strconv"
 
 	"github.com/go-chi/chi/v5"
 
@@ -39,14 +40,24 @@ func AsAuthzSystem(mws ...func(http.Handler) http.Handler) func(http.Handler) ht
 	}
 }
 
-// RecordAuthzChecks enables recording all of the authorization checks that
+// RecordAuthzChecks enables recording all the authorization checks that
 // occurred in the processing of a request. This is mostly helpful for debugging
 // and understanding what permissions are required for a given action.
 //
+// Can either be toggled on by a deployment wide configuration value, or opt-in on
+// a per-request basis by setting the `x-record-authz-checks` header to a truthy value.
+//
 // Requires using a Recorder Authorizer.
-func RecordAuthzChecks(next http.Handler) http.Handler {
-	return http.HandlerFunc(func(rw http.ResponseWriter, r *http.Request) {
-		r = r.WithContext(rbac.WithAuthzCheckRecorder(r.Context()))
-		next.ServeHTTP(rw, r)
-	})
+//
+//nolint:revive
+func RecordAuthzChecks(always bool) func(next http.Handler) http.Handler {
+	return func(next http.Handler) http.Handler {
+		return http.HandlerFunc(func(rw http.ResponseWriter, r *http.Request) {
+			if enabled, _ := strconv.ParseBool(r.Header.Get("x-record-authz-checks")); enabled || always {
+				r = r.WithContext(rbac.WithAuthzCheckRecorder(r.Context()))
+			}
+
+			next.ServeHTTP(rw, r)
+		})
+	}
 }