Implement issuer tokens [closes #9]

Issuer tokens allow third parties to issue badges directly to a backpack, but do nothing else – they only get access to the `POST /user/:id/badges` route.

This implements a new model, `IssuerTokens` to hold those tokens, as well as a new binary `bin/generate-tokens`, so key/token sets can be generated via the command line:

![generate-tokens](https://i.cloudup.com/Mvw3ZeuaUS.png)

This key/token pair can be given to an issuer who would use it to generate their `Authorization` header when sending in a request.

The whole auth module with user types and permissions is overkill for this requirement, but what I will do is make the endpoint whitelists go in as part of the middleware configuration, e.g. something like 
```js
server.use(verifyRequest({
  whitelists: {
    // no authorization check peformed
    global: ['/', '/healthcheck'],

    // issuers can only access these routes (in addtion to above)
    issuer: [
      '/auth-test',
      /^\/users\/.+?\/badges\/?$/,
    ],
  },
}))

```