Refactor authenticaiton into part of relengapi proper.

This removes the dependency on Flask-Principal, and focuses all auth
info on `current_user`.

Token auth is temporarily broken.
Rename actions -> permissions, relengapi.actions -> relengapi.p

This is an incompatible change: lots of names change, and config
(RELENGAPI_ACTIONS -> RELENGAPI_PERMISSIONS) changes.