2755: add support for signed locators in the Python SDK.

* arvados.Keep.put() saves the response body (which may contain a
  signed locator) and returns it to the caller.

* arvados.Keep.get() passes the full signed locator to the remote Keep
  server. The bare MD5 hash is still used for caching and for
  shuffled_service_roots

* run_test_server.run_keep() takes arguments 'blob_signing_key' and
  'enforce_permissions', for testing permission signatures in unit
  tests.

* test_keep_client: new unit tests for permissions:
    - with --enforce-permissions=true:
        - GET with a signed locator works
        - GET with an unsigned locator fails
        - unauthenticated GET fails
    - with --enforce-permissions=false:
        - GET with a signed locator works
	- GET with an unsigned locator works
	- unauthenticated GET works

Bug fixes to permission handling in the Keep server:

* Locator hints may appear in any order; be flexible. Parse them in
  GetBlockHandler rather than in the REST router.

* Returned locators are terminated with newline (consistent with
  Warehouse, and more friendly for human debugging).

* The locator returned from a PUT request always has a size hint.

* The correct Authorization header keyword is "OAuth2", not
  "OAuth". D'oh.

* Updated unit tests to accommodate newlines, size hints and OAuth2.

Refs #2755.
2755: incorporate code review.

* Unit tests cover all permutations of signature/authorization when
  --enforce-permissions=false

* Keep is more forgiving about the structure of locators, permits
  locator hints of unknown type (as long as they begin with an uppercase
  letter)

* Keep delivers 400 Bad Request for requests that do not match any
  route, or are lexically invalid. 404 Not Found only for requests with
  a syntactically valid hash not found on disk.

Refs #2755.
Merge branch '2755-python-sdk-permissions'

Refs #2755.