Add API tokens [finishes #75075490]

* api_tokens database table
* secure random token generation
* GET /documentset/:id/api-tokens
* POST /documentset/:id/api-tokens
* DELETE /documentset/:id/api-tokens/:token
* delete tokens when deleting document set

No need to delete tokens when deleting user: you can't delete a user who
has a document set.