Create API bundle

 * Removes the generic Middleware bundle and creates an API bundle in its place
 * Allows for development of other bundles
 * Allows for non-bundle code

Merges into `feature/event-sourcing` master PR.
I did consider `Surfnet\Stepup` as the domain namespace. I can go with this. This would create the following autoloading scenario, which is just fine:

```json
{
    "psr-4": {
        "Surfnet\\StepupMiddleware\\": "src\\Surfnet\\StepupMiddleware",
        "Surfnet\\Stepup\\": "src\\Surfnet\\Stepup",
    }
}
```