[WIP] Remove authentication for public endpoints

WIP solution for https://github.com/TryGhost/Ghost/issues/4181

Feedback welcome!

Description:

There is a file core/server/api/publicEndpoints.js that defines all of the publicly available endpoints. These are represented as an array of objects. Each object contains a regex which matches the endpoint, an array allowable verbs (just GET for now - probably forever?), and optionally an array of objects which represent the allowable get queries.

In the middleware, before authentication occurs, the request path is passed along to the publicEndpoints module. The module tries to exist ASAP. If it doesn't match a public regex, false is immediately returned. Otherwise a check on the request method (GET) is performed, if it is anything other than the whitelisted verb, the test fails. Finally, get parameters are checked, if any extra or unexpected queries are sent along the entire test fails. If all the tests pass, then the module returns true and the middleware bypasses authentication sending an empty object instead of a user. This breaks a couple of the operations because a user model is expected. A potential solution is to have a built in Public API user which is used only for public facing API calls.

This seemed like a good approach as it makes it simple to add public calls (just add an object with the appropriate regex for the route, allowed verbs and allowed queries) and removing a public route just means removing the corresponding object.

Right now, the regexes are hard coded which isn't that big of a deal with the exception of the API version. This should be dynamically built based on a configuration so that when the API version updates, this code doesn't need to be changed.