Adds auth package with token auth backend

Adds an interface for AccessController which handles verifying that a request has sufficient access for the current operation.

Implements a "token" AccessController which handles bearer tokens in the form of signed JSON Web Tokens.
hmm, I should probably refactor this to handle both. Right now it only handles the case where the JWT header has either a `kid` or `jwk` field, but not a `x5c` field. I could then separate the x5c chain validation into a separate function that verifies it and returns the leaf key as a `libtrust.PublicKey`