Serialize/De-serialize Command principal for ScheduledCommand

[yuanfeiw]

ScheduledCommand is NOT using the command principal, rather the thread's principal. This is likely caused by Command principal not serializable.

[jonsequitur]

After talking this through with a few people I think that it's best not to serialize the original principal. This has a risk of leaking secrets, such as claims. And the command scheduler delivering commands should be considered a different actor in the system, e.g. a service principal. This implies that scheduling a command requires an authz check, which doesn't currently exist. Or, if the scheduled command is intended to persist permissions, they will need to be specific to the authz approach being used by the user of Its.Cqrs, and encrypted, e.g. JWT.