[api] move the actual auto accept out of the clock daemon

The clock daemon stops while doing jobs, so everything that takes
longer than a couple of milliseconds should only trigger a delayed
job

While I was at it, I moved the rather huge and clumpsy BsRequest.collection
function into a model on its own (to be further refactored)
[backend] add a notify_api notification plugin

It simply takes the params as JSON and POSTs it to /events in the
configured $apiurl - this needs to be pushed from the api at one
point though
[api] add an events controller

that POST to /events serves as notification route in the backend to
replace hermes
[api] work on subscribtions to events

You can subscribe globally or on project/package leel if you want to
get notifications (not yet implemented obviously) for events either
for
- none (overwriting more global defaults)
- project maintainership
- package maintainership
- all

Webui part to be written
[api] adding a route to retrieve subscriptions for the webui to display
[api] STI does not make sense for subscriptions

The classes don't do anything, it's just a property of the subscription.
I had a slightly different approach in mind when I went STI, but it
didn't work out

- allow to update user subscriptions
[webui] add basic functionality to edit user subscriptions
[backend, api] have the clock daemon send notifications out

Do no longer support hermes directly in backend