Extended SecurityEngine to support access tokens

Added methods to the Balsa SecurityEngine interface to support
generating and verifying access tokens.

Added a default implementation based on CryptoCookies.

This is the first phase in adding stateless request verification,
enabling access tokens to be verified without requiring session
state.