api: More consistency in test helper methods.

I keep accidentally rewriting the methods in ArvadosTestHelper, so I'm
putting them in one module loaded for all tests so I can use them
consistently.
api: Introduce reader_tokens for extra access.

reader_tokens are API tokens whose read permissions will be added to
the primary API token's.  For actions that only read resources, like
:index and :show, you can now omit the API token as long as you
provide at least one reader_token.

This allows users to get access to one-off resources without
interrupting their primary session.  For example, Workbench will use
it to access Collections shared via secret link.
api: Accept JSON-formatted reader token array.
Merge branch '1904-api-reader-tokens'

Closes #2702, #2707.