[WIP] Initial implementation of ClaimCode.reservedFor.

## Motivation and Rationale

Issuing badges from the OpenBadger admin interface is problematic because there's a lot of information we need to know to issue a badge to the proper recipient and notify them of the issuance.

For example, if the recipient is < 13, the email address entered in the OpenBadger admin UI might be the guardian's email. While that guardian should be notified about the badge issuance, we don't actually know which email to issue the badge to yet, as the guardian will need to pick a child to actually award the badge to. Only CSOL-site knows about what children a guardian has stewardship over, and as it's the only learner/guardian-facing website, it makes sense for it to be the one that sends an email with any necessary links back to itself.

Thus rather than immediately issuing a badge and emailing its recipient, it makes more sense for Openbadger to create a kind of claim code that's "reserved" for someone, and then notify CSOL-site about the reservation via a webhook. This allows CSOL-site to handle the situation in the best way possible. Here's some examples of what CSOL-site might do, which OpenBadger doesn't have the knowledge to do itself:

* If the email address doesn't exist as an account on CSOL-site, CSOL-site can automatically create an account for them (reducing signup friction) and then invite the user to it so they can either issue the badge to their kid (if they turn out to be a guardian) or have it immediately issued to themself (if they're a learner over 13).

* If the email is known to be a guardian, CSOL-site can email the user with a link back to itself so they can choose what kid to award it to.

* If the email is known to be a > 13 learner, CSOL-site can automatically claim the badge for them and notify them via email.

Also, for #122, where we want to allow OpenBadger issuers/admins to issue badges *with evidence*, we must acknowledge that OpenBadger itself has no concept of evidence other than a single URL in an open badge assertion: every individual piece of evidence is actually stored and displayed to users by CSOL-site, not OpenBadger. Thus, one way of implementing this feature will be to (eventually) add additional fields to reserved claims that allow them to temporarily hold evidence uploaded by issuers/admins, at which point CSOL-site can fetch them when notified of the reserved claim.

## Implementation

This pull request implements the notion of a reserved claim code in the badge/claim model, along with a new Badge method, `reserveAndNotify()`, which creates a reserved claim code, and changes the `issueMany` badge route to call it.

Things left to do (either by this PR or subsequent ones):

- [ ] Call a webhook when `reserveAndNotify()` is called, defined by an environment variable such as `OPENBADGER_NOTIFICATION_WEBHOOK`.
- [ ] Make the POST `/v2/user/badge/<shortname>` and POST `/v2/claim` API endpoints return information about any STEAM badges that were also awarded. This will allow CSOL-site (or other trusted clients like DYN) to send email notifications itself whenever it issues badges, by simply looking at the return value of the API call. (This implies that the webhook will only be called when a badge is "issued" from the OpenBadger UI.)
- [ ] Documenting the changes to the above API endpoints in `docs/api.md`. Also documenting that their callers are responsible for communicating the awarding of any badges made as a result (including STEAM badges) to the recipient.