Initial nextjs api endpoint commit

[dgading]

This PR aims to create a NextJS api endpoint that can update the homepage goals search. With NextJS Drupal, each request for information needs authorization credentials passed with it. NextJS uses environmental variables to do this when building the site with functions like getStaticProps. These credentials are never passed to the browser, so updating the site with new data from the view can't be done like a normal React application where you just fetch some new data.

In NextJS, using the api subfolder in the pages folder, you can create API end points that live on the server part of the NextJS application. These pages are never sent to the browser, but can be used be the browser part of the site to access the Drupal site. In this PR I've added the endpoint /api/goal-search which can take a query of fulltext. This endpoint then works similar to the getStaticProps on page load, when a request hits the endpoint, it sends a graphql query to the Drupal site with the auth information and returns the information through my new endpoint to the browser application. When using the application, if you use the goals search, you will never see the Drupal endpoint, only the NextJS api endpoint I created.

[dgading]

Linking the NextJS tutorial page which probably explains it better than I did https://nextjs.org/learn-pages-router/basics/api-routes

[openprivacy]

@dgading thanks for the link - quite a rabbit hole that I never got to the bottom of. It seems NextJS is being secure here, but as with writing any APIs, whoever reviews your code should keep the OWASP API Top 10 in mind.
https://owasp.org/API-Security/editions/2023/en/0x11-t10/