Add new managed resources implementation

A new ManagedStorage interface allows blobs to be stored in a mongo database. The blobs are initially namespaced to an environment but apis will be added to the interface to allow data to be stored globally or against a given user.

Data is de-duped when Put - if there is already a blob with the same checksums (md5/sha256) it is not stored twice; a reference to the original data is used.
Does it matter that the caller could form a resourcePath that clashes with namespaced paths? e.g., the two following calls would yield the same path:
```go
resourceStoragePath("", "", "environs/0123456789abcdef/users/bob/thing")
resourceStoragePath("0123456789abcdef", "bob", "thing")
```

Do you need to put in another path element to discriminate the beginning of the caller-specified resource path?