core/api-spec: add access token API
core/api-spec: add access token API

This commit proposes a relatively simple authentication scheme for RPC
calls,
based on access tokens issued by the core administrator.

The backend implementation is assumed to be as follows:

- Cores may optionally require access tokens for application and network
RPC endpoints. There are two types of tokens, one for application RPCs, and
one for network RPCs.
- Tokens are stored in the database with unique, user-provided IDs and
randomly-generated secrets, stored in hashed form.
- Clients pass token IDs/secrets as username/password pairs in the HTTP
Basic Auth header.
- RPC routes have authentication middleware that check basic auth
parameters against the token database. Caching is performed as necessary.

A new endpoint, `/update-configuration`, has also been added. This gives
the core admin the ability to require access tokens.

Closes chain/chainprv#1819

chain/chain,chain/chain,chain/chain,chain/chain,chain/chain,chain/chain