Implement `doNotList` attribute on badges

closes #77 (https://github.com/mozilla/openbadger/issues/77)

There are some cases where we don't want to list a badge as part of an
API response. This changeset provides the backend attribute and the
frontend for managing that attribute.