Add RFC: libobs keychain APIs

Author: derrod

text/0000-libobs-keychain-api.md

@@ -0,0 +1,69 @@
+# Summary
+
+This RFC proposes the addition of OS keychain APIs to the libobs platform utilities to faciliate secure storage of credentials.
+
+# Motivation
+
+While the credentials stored by OBS in profiles are not of severe sensitivity due to limited scope, as a modern desktop application we should still do our best to store them securely.
+
+# Detailed Changes
+
+This RFC proposes the addition of the following libobs API methods:
+
+- `bool os_keychain_save(const char *key, const char *data)`
+- `bool os_keychain_load(const char *key, char **data)`
+- `bool os_keychain_delete(const char *key)`
+
+As the API requires OS-specific implementation it shall become part of the `util/platform.h` header.
+
+Operating-system backends:
+- Windows: `wincred.h` / `Cred*` Win32 API functions
+- macOS: Keychain Services API
+- Linux: `libsecret`
+
+On some platforms we may add a prefix such as `obs-studio:` to identify keychain an entries as an OBS-related to the user. This is already common practice with many applications such as git, RDP, or Xbox Live.
+
+**Usage examples:**
+Saving:
+```c
+const char *key = "ProfileName::StreamKey";
+const char *value = "mystreamkey";
+bool success = os_keychain_save(key, value);
+```
+
+Loading:
+```c
+const char *key = "ProfileName::StreamKey";
+char *value = NULL;
+bool success = os_keychain_load(key, &value);
+
+... do stuff ...
+
+if (value)
+    bfree(value);
+```
+
+Deletion:
+```c
+const char *key = "ProfileName::StreamKey";
+bool success = os_keychain_delete(key);
+```
+
+# Drawbacks
+
+Accessing keychain information can reduce portability of profiles by not storing OAuth information or stream keys in plaintext files.
+
+In some cases accessing the keychain may require user confirmation, the API may block in such cases, which has to be accounted for by consumers.
+
+On Linux the situation may be more complicated. While both GNOME and KDE provide a "Secret Service", other desktop environments might not. This will require further investigation.  
+In some case such as Flatpak this may be achieved by using the `Secrets` portal and encrypting information stored using the application-specific key provided by the `RetrieveSecret()` API.
+
+If no OS keychain implementation is available OBS might need to be able to provide a file-based store that can be fallen back to at compile time.
+
+# Additional Information
+
+- Windows credential store documentation: https://learn.microsoft.com/en-us/windows/win32/api/wincred/
+- macOS keychain documentation: https://developer.apple.com/documentation/security/keychain_services?language=objc
+- Linux/GNOME libsecret documentation: https://gnome.pages.gitlab.gnome.org/libsecret/
+- Flatpak "Secret" Portal: https://docs.flatpak.org/en/latest/portal-api-reference.html#gdbus-org.freedesktop.portal.Secret
+- Proof of Concept for storing OAuth information in the keychain (no libobs changes, reference for Windows API usage only): https://github.com/derrod/obs-studio/commit/8c04a72ae6c6255f8895a168d0fc33d0a99bc2ec