Added webhook testing API endpoint at `/v2/test/webhook`.

This simply passes the `email` and `claimCode` given by the client on to
the `OPENBADGER_NOTIFICATION_WEBHOOK`, and returns a 200 OK response if
the webhook returns 200, a 502 bad gateway response otherwise. Additionally,
the body of the payload to the webhook contains the parameter `isTesting` set
to `true`, so that the webhook endpoint knows not to treat the ping
seriously. The API endpoint only returns a response when the webhook
notification has completed.

A robust health check on the openbadger client might create a DB entry
for a fake claim code and have their webhook remove it when it is
pinged and `isTesting` is set to `true`. The client could then ping
`/v2/test/webhook` with the fake claim code, and then ensure that
both the response is OK and the claim code no longer exists in
its db.
Tests for /v2/test/webhook also test JWT.
protect webhook test endpoint behind api jwt auth.
Merge pull request #213 from toolness/webhook-testing-api

Added webhook testing API endpoint at `/v2/test/webhook`.