Modify WebStatus auth to allow for external authenticators.

This commit modifies auth/authz such that implementations of IAuth can
specify custom login URLs. It also attempts to work around auth's
current assumption that all users will have a visible username and
password.

The intent is to make IAuth extensible enough that authentication could
be delegated to a third party identity provider (e.g. Google OAuth2).
In that case the custom login URL would point to the external service's
authentication endpoint and the IAuth.authenticate call would implement
whatever callback logic is necessary to verify and complete the authentication.

Users authenticated in this mode would have a unique identifier
("username"), but would not have a password. While they may have some
password-like access token, we leave it up to the IAuth implementer to
handle these in whatever way he sees fit.
Add WebStatus authz "view" action.

This commit adds a new action to authz called "view". This action
represents the ability to view the Buildbot's WebStatus. If, for
example, you set `view='auth'` in authz, a user must be logged in to
view any meaningful status information.

The exception is that the root page and the login action are
whitelisted to always be viewable since these are necessary to log in.

Using this authz action it becomes possible to run a "private" Buildbot
instance for projects that don't wish to expose themselves to the
Internet at large.
Merge branch '2_view_action'