Require a valid bearer token for PUT requests

Most of this is taken from the HMRC manuals API:

    https://github.com/alphagov/hmrc-manuals-api/pull/29

This uses secrets.yml for the oauth_id and oauth_secret, so we only need to
override that file on deployment to set environment-specific credentials.

gds-sso has a shared example which can be used to test an app's User class, to
ensure that it implements the necessary methods for gds-sso to work:

    https://github.com/alphagov/gds-sso/commit/81900f018fe6fc4c3ba31313ca07212eb98402b7

...but we aren't using it at the moment. The examples assume that the
app needs to support pushing of permissions, which we don't because we have no
persisted users and instead authenticate through signon for every request. We
should separate out the examples in gds-sso so that it's possible to use a
minimal shared example, with support for pushing permissions being optional,
but until that's done there's no point in implementing unused dummy methods
here to make all of the existing tests pass.

These methods on User need to be present to make the mock authentication
strategy used in tests (and dev by default) work:

- self.where
- self.first
- update_attribute

self.create! also needs to be defined for the real authentication strategy
to work.

The implementations of all these methods come from the HMRC manuals API, except
for using public_send instead of send in update_attribute. The HMRC API also
defines some other methods on User, but I can successfully authenticate in dev
using the real strategy without them, so I haven't copied them across here.