Use `analyzeAssertion` in issuer endpoint

Before we had a few nested steps: first we would get the assertion, do
some validation, then get the badge image, then try to award. There were
a lot of points where the process could fail and the parts weren't easy
to test independently.

I've replaced the first two steps with `analyzeAssertion`, which uses
openbadges-validator underneath. It deals with the error handling when
an assertion url is malformed or unreachable, and defers to
openbadges-validator for the rest of the error handling.

There are still some ways to clean this up - the `analyzeAssertion call
should probably exist and middleware and the GET and POST conditional
parts should be two different endpoints - but this is a start.