Piping hot baked badges [closes #11]

This adds one new model, and one new route. It also modifies one old model and one old route.

* New route: `GET /public/images/:badgeImageSlug` (which is auth whitelisted) for serving baked badges. Uses the 
* New model: BadgeImages, which stores the badge image data (in base64).
* Modified model: EarnerBadges, added `badgeImageSlug` foreign key.
* Modified route: `POST /user/:userId/badges`, the interface remains the same however as part of the saving process, the remote badge image will be fetched, baked and stored locally in the BadgeImages model.
* Modified route: `GET /user/:userId/badges`, add `badgeBadgeUrl` to each of the badges in the `badges` array.
* Modified route: `GET /user/:userId/badges/:badgeId`, add `bakedBadgeUrl` to response
Yep, the assumption is that BadgeAssertion images are already pre-baked so we don't touch those. We always bake the BadgeClass, and then we provide both URLs, the (presumably baked) remote imageUrl from the assertion, and the known-to-be-baked local URL. It's up to the frontend to decide which to use.

We could (and probably should, at some point) verify that if we're given a BadgeAssertion image that it's baked, but I would rather not tackle that in this PR.