Authorization handlers structure.

This PR adds the necessary structure to start supporting Authentication/Authorization.

This has to be seen as the base to build on top of it, since there are some gray areas that need more work. Namely:
  - Make the authentication required and its flow more like D8, where we default to cookie auth and if that fails the anonymous user is returned. Right now if you don't use `authentication required` in your plugin definition, no authentication happens.
  - Make the `RestfulAuthenticationBase` class to have a `canAuthenticate` method (similar to D8 Authentication Manager).
  - Add authentication for Basic Auth. This shouldn't be that hard.

What this has:
  - The business logic to add the authorization plugins into the restful handler.
  - The business logic to return a 403 if the authorization fails.
  - A new `authorization` plugin type to define authorization types. We may need an `authentication` type in the future, I'm not quite sure yet.
  - A **dummy** auth-z plugin that will check the presence of a key/value as a GET param. The key and value are stored in a variable. This base class may be leveraged to check the presence of any negotiated token in the future (thinking about OAuth, Facebook, …).
  - Some extra helper methods in `RestfulEntityBase`.
  - Tests for the GET param authentication type.

Maybe @juampy72 is curious about this PR.

:boom: