Introduce Current per-request attributes singleton

This creates an idiomatic Rails per-request attributes singleton
`Current`, using [`ActiveSupport::CurrentAttributes`], and stores the
current user in it. This will allow us to access the currently active
user in cross-cutting concerns, without having to deeply pass it around.

`CurrentAttributes` is a "sharp tool" that should be used with caution
as it creates global state for a request, but is an ideal tool for
dealing with auditing and logging concerns (which we'll soon introduce)
where you need to have global awareness of certain request attributes
outside of just the controller layer.

We have prior art for this pattern, for example in Whitehall.

[`ActiveSupport::CurrentAttributes`]: https://edgeapi.rubyonrails.org/classes/ActiveSupport/CurrentAttributes.html

app/controllers/application_controller.rb

@@ -1,8 +1,7 @@
 class ApplicationController < ActionController::Base
+  include AuthenticatesUser
+
   # Prevent CSRF attacks by raising an exception.
   # For APIs, you may want to use :null_session instead.
   protect_from_forgery with: :exception
-
-  include GDS::SSO::ControllerMethods
-  before_action :authenticate_user!
 end

app/controllers/concerns/authenticates_user.rb

@@ -0,0 +1,14 @@
+# Enforces user authentication for a controller and stores the authenticated user in `Current`
+module AuthenticatesUser
+  extend ActiveSupport::Concern
+
+  included do
+    include GDS::SSO::ControllerMethods
+
+    before_action do
+      authenticate_user!
+
+      Current.user = current_user
+    end
+  end
+end

app/controllers/recommended_links_controller.rb

@@ -59,6 +59,6 @@ def set_recommended_link
   def recommended_link_params
     params
       .expect(recommended_link: %i[link title description keywords comment])
-      .merge(user_id: current_user.id)
+      .merge(user_id: Current.user.id)
   end
 end

app/helpers/application_helper.rb

@@ -1,6 +1,6 @@
 module ApplicationHelper
   def navigation_items
-    return [] unless current_user
+    return [] unless Current.user?
 
     [
       {
@@ -14,7 +14,7 @@ def navigation_items
         active: controller.controller_name == "controls",
       },
       {
-        text: current_user.name,
+        text: Current.user.name,
         href: Plek.new.external_url_for("signon"),
       },
       {

app/models/current.rb

@@ -0,0 +1,8 @@
+# Stores cross-cutting concerns for every request
+class Current < ActiveSupport::CurrentAttributes
+  attribute :user
+
+  def user?
+    user.present?
+  end
+end