Proposal: Registry v2 authorization service

Outlines usage for endpoints which will be used by the
docker registry client for registry v2 non-standalone.

Docker-DCO-1.1-Signed-off-by: Josh Hawn <josh.hawn@docker.com> (github: jlhawn)
Requiring the server that satisfies auth to be `<dns>/token/` means integrators will need to own an entire domain.  That makes it more difficult for services to provide '/token/' style integration while supporting other workloads.  It would be better if the authenticate challenge also included a path prefix as part of realm or as an additional parameter to allow third parties to better implement this.

```
HTTP/1.1 401 Unauthorized
WWW-Authenticate: Token realm="thirdparty.server.com/somepath",service="registry.docker.com",scope="repository:samalba/my-app:push namespace:samalba:push"
```

and then the client would hit "/somepath/token".