Identity Provider

Add an identity provider interface to state and an implementation for agents. User, Unit and Machine tags use the AgentIdentityProvider to authenticate.
"as well as users"? This seems surprising. Shouldn't we have one for the machines/units (which is easy) and another layer that returns a suitable identity provider for a given user? At the moment, I agree, we've got the same stuff backing local user identities as we do machine/unit ones, but I'd prefer it if we didn't use an *Agent*IdentityProvider to back user logins.

Perhaps we could just call it a LocalIdentityProvider here, and split it up in the next branch? Not sure if that's in line with current plans...