The dependency review action failed here and says it's not supported, so we should remove it from our tests.yml.

I tested this and it's working (see my update on https://hathitrust.atlassian.net/issues/TTO-203) but I'm not sure what the best thing to do is regarding deploying this.

I'm kind of inclined to discard what we have on the master branch here and just reset that to upstream master. Then, we can manage future updates by applying our patches in a branch against upstream tagged releases, and then just tagging that rather than merging it to any particular branch. Not really sure if there are some best practices/patterns out there for dealing with this kind of pattern. I've had to do this kind of thing (long-term fork with our patches) a couple times, and it's been frustrating both times -- as opposed to building debian or redhat packages or something, where there's a well-documented and widely-used pattern for applying local patches to an upstream release.

Going to tag this branch, close the PR, and manually set main to this.

It also looks like the upstream auth proxy now supports headers for additional claims: dexidp@366e53c
so we may be able to use that directly rather than needing to maintain a fork. I'll look into that in the future.