sign notebooks

This adds notebook signing for protecting dynamic output from running at load.

- signature is stored in notebook.metadata.signature
- signature is checked on open / written on save server side, in the NotebookManager
- auth flag is set on cells when sent to Javascript via REST API
- untrusted outputs are not displayed, instead a warning message is shown and display proceeds to safe output types

Needs tests before this is is ready to merge.