Adds auth package with token auth backend

Adds an interface for AccessController which handles verifying that a request has sufficient access for the current operation.

Implements a "token" AccessController which handles bearer tokens in the form of signed JSON Web Tokens.
Per our conversation, let's add this to the `common` package as `stringset.go`. There may be future uses and I'd rather export a type once and not use it elsewhere rather than end up with 10 string set implementations.