Implement badge issuing [closes #12]

This implements badge awarding routes, as well as the public routes necessary for serving the badge assertion, badge class and issuer organization objects. This also implements a new data model, `webhooks`, which keeps track of webhook related information – currently `url` & `secret`. These are one-to-one with `systems`.

When a new badge is awarded, the `badgekit-api` will respond to the original requester, *then* try to make any webhook requests. This ensures the success or failure of the webhook does not affect the original award request as they are not necessarily related.

Webhooks are sent with a JWT token in the `Authorization` header in the format `JWT token="<jwt-token>"`. There is one claim, `body`, which has two fields, `hash` and `alg`. Right now alg is set to "sha256", and `hash` is the `sha256` hash of the body of the outgoing request. A webhook consumer can use the `Authorization` header to ensure the hook came from an authorized provider.

@andrewhayward to review