Improve /auth API request sanitation (#5843)

* Add basic test coverage for /auth API

* Check /auth API is called from an add-on

Currently the /auth API is only available for add-ons. Return 403
for calls not originating from an add-on.

* Handle bad json in auth API

Use the API specific JSON load helper which raises an APIError. This
causes the API to return a 400 error instead of a 500 error when the
JSON is invalid.

* Avoid redefining name 'mock_check_login'

* Update tests/api/test_auth.py

tests/fixtures/addons/local/ssh/config.yaml

@@ -18,6 +18,7 @@ panel_title: Terminal
 hassio_api: true
 hassio_role: manager
 homeassistant_api: true
+auth_api: true
 audio: true
 uart: true
 ports: