OCS API for server-to-server sharing

OCS API for server2server sharing as part of #12285 .

This is work in progress, I just want to give people a chance to look at it early.

This is how the API will look like:

POST to create new server2server share
```
http://localhost/oc/ocs/v1.php/cloud/shares
```

post data: shareWith, token, name, remote, remote_id, owner

POST to notify that the share was accepted
```
http://localhost/oc/ocs/v1.php/cloud/shares/{shareId}/accept
```

post data: token

POST to notify that the share was declined
```
http://localhost/oc/ocs/v1.php/cloud/shares/{shareId}/decline
```

post data: token

POST to unshare server-to-server share
```
http://localhost/oc/ocs/v1.php/cloud/shares/{shareId}/unshare
```
post data: 'token'
> The problem here is that while unshare we call the unshare hook to which various apps will listen. E.g. encryption to remove the corresponding share key. This hooks expect that unshare was triggered by a logged-in user getUser() for example to construct the correct path.
> Since nobody login here there will be no session from a specific user. So what is the concrete problem if I set the user in the session for this call?

The problem is that you create a valid session for `$share['uid_owner']` and neither the token nor the id are really secrets. If you have access to a public share you know the token and enumerating an ID is just a 20liner.

The problem here is:

1. You share the folder "bar" publicy
2. You sent the link of "bar" to Bob
3. Bob accesses the decline URL
4 . Bob receives a valid session (the one in set-cookie), with that session he is authenticated (just copy this in your browser and enjoy being logged-in)

> Any other idea how to solve the problem?

No. But no magic with `setUserId` please. Also unsetting it after that is not what we should do.