Allow authentication header to be passed-thru to upstream when resolving packages.

I love sinopia. It's shaping up to be like the swiss-army knife for bespoke npm registry setups.

Let me explain what this is for a little. We want to roll our own private NPM registry for our internal packages. However, we already have multiple sinopia proxies in place for different geographical locations. These proxies currently require no authentication, as they were just there to speed up resolving requests to the public NPM registry. Now that we want private NPM endpoints, we want developers to be able to continue using the "edge proxies" - but certain packages will split out to hit a different registry. When that happens, we want to be able to put sinopia into a sort of "dumb mode", in which its own ACL is ignored, but it forwards the request *including* any given authentication data to the upstream.

One of the primary reasons we want to do this is to avoid needing to roll authentication on every edge locations. Here's a naive example of how this PR would be useful:

Imagine this in your config.yaml:

```
packages:
  'private-*':
    allow_access: all
    auth_passthrough: true
    proxy: private-registry
  '*':
    proxy: npmjs
```

In the example above, this PR will ensure that sinopia doesn't do any ACL checks, but passes the inbound authentication header along to the `private-registry`.

An aside, part of this use-case is we're going to want to be able to completely disable resolved packages from upstream being persisted in local storage for certain package patterns. Is that currently possible? If not, I'll be submitting another PR for that :)