Improvements so that remote user can be obtained from reauth.

When logging into with a remote identity, the user ID might not be known
up front when initiating the authentication process. Allow the remote
identity service to declare the user ID with a first party caveat --
and require that a user ID is declared when reauthenticating to Juju.

apiserver/authentication.RemoteAuthenticator no longer implements
EntityAuthenticator, since it now needs to return the entity from
declared user caveat in the identity service discharge macaroon.

This, and the fact that the Admin.Login API call is getting pretty badly
overloaded, seems to indicate the need for further refactoring. Admin v1
methods for obtaining a challenge macaroon and reauthenticating with it
should be separated out.
Merge branch 'cmars-002-macaraq' of github.com:cmars/juju into cmars-002-macaraq