A first attempt at validator.getAssertionGUID().

There is currently no way to represent a badge as a globally unique identifier, which means--among other things--that there is no way to definitively ask an OpenBadges-compliant backpack if a user already has a badge.

This PR proposes a new function called `getAssertionGUID` which takes either a hosted assertion URL or a JWS-signed badge assertion as an argument. It returns a hex-encoded SHA256 digest that uniquely identifies the badge.

If the assertion is hosted, the GUID will be the SHA256 hash of the following string:

`hosted:` **assertion URL**

If the assertion is signed, the GUID will be the SHA256 hash of the following:

`signed:` **assertion UID** `:` **origin of assertion's public key**

For example, if the signed assertion's public key is hosted at `https://example.org/public-key` and the assertion's UID is `abcd`, then the assertion's GUID will be the hex-encoded SHA256 hash of `signed:abcd:https://example.org`, or `61ae9c039ecc7d08cac6fea3ed6fa3d47463b34e3f2f3bbe86be33688b2f105a`.

Still need to:

- [x] document this in the README
- [x] ~~add a `guid` property to the object that the `validator` function returns~~

*Not doing the second part because hosted assertion metadata can be passed to the validator with no knowledge of where it lives in the 0.5 case.*