WIP: all dangerous urls needs now a valid user or a valid API key

 * Tests are not adapted yet
 * script/client contains now an example implementation of HMAC authentication
   that needs to be extracted and generalized
 * A user with is_operator = true is needed in the web interface
 * An API key associated to such a user is needed if no browser is present
 * TODO: CSRF should probably be removed from clients
WIP: CSRF is not longer used with HMAC

 * Included a helper function for simulating openID login during tests
 * Only the API tests are broken because a proper OpenQA::Client module is
   needed
WIP: preliminary version of API::V1::Client
02-iso.t adapted to the provisional API::V1:Client so tests are green again
UI for managing API keys
Revert "02-iso.t adapted to the provisional API::V1:Client so tests are green again"

This reverts commit f81415bc25c9a8c23cddf273f6625ec36c411c4a.
make OpenQA::API::V1::Client a Mojo::UserAgent
Tests (and some improvements) in API key management UI
Some tests for authentication
Renaming a test
add config file for secret and key
add docu for OpenQA::API::V1::Client
make worker check config settings
Tests for API authorization
Fixing a bug introduced in the rebase of the auth branch