oauth2server: initial release

* Initial release of OAuth2 provider for Invenio.

* Adds settings view for configuring applications and personal
  access tokens (WIP).

Signed-off-by: Lars Holm Nielsen <lars.holm.nielsen@cern.ch>
webhooks: initial release

* Adds REST API endpoint for receiving webhooks notifications
  from external services and pass the request payload to a
  Celery task for background processing.

Signed-off-by: Lars Holm Nielsen <lars.holm.nielsen@cern.ch>
restful: apikey and oauth2 authentication support

* Adds support for API authentication via both API keys
  and OAuth 2.0.

* Adds pending deprecation messages to API authentication, which
  will be replaced by OAuth 2.0 personal tokens authentication.

* Fixes an issue where API response headers would include a
  set-cookie header.

* Aligns unauthenticated response status code to 401 for API key and
  OAuth authentication.

* Downgrades empty session log message from error level to debug
  level.

Signed-off-by: Lars Holm Nielsen <lars.holm.nielsen@cern.ch>
accounts: settings initial release

* Adds new settings blueprints and templates for easy creation of user
  settings (WIP).

* Moves views to package blueprint.

* Adds CFG_ACCOUNT_MIN_PASSWORD_LENGTH configuration variable.

* Updates form text labels.

Signed-off-by: Lars Holm Nielsen <lars.holm.nielsen@cern.ch>
formatter: encoding error fix

* Fixes an encoding error due to CFG_SITE_URL being unicode.

Signed-off-by: Lars Holm Nielsen <lars.holm.nielsen@cern.ch>
login: fix permission issue for guest user

* Fixes a permission issue where a guest user did not have a list of
  permitted restricted collections calculated, causing issue with
  e.g. facets when viewing restricted collections (e.g. restricted to
  role anyuser).