Exposure of a valid Gitlab-Workhorse JWT leading to various bad things

Using the **State** Uploading API we could potentially do a bad thing: - Bypass `Gitlab::Workhorse.verify_api_request!`

 desc 'Add a new terraform state or update an existing one'
          route_setting :authentication, basic_auth_personal_access_token: true, job_token_allowed: :basic_auth
          post do
            authorize! :admin_terraform_state, user_project

            data = request.body.read