Implement a view endpoint for activating public keys

The endpoint takes a confirmation key in the URL and activates the
public key. By default, it returns an HTML response, but a JSON
response can be explicitly asked for by appending '.json' to the
URL.
Add support for detecting expired confirmation keys

A method on the PublicKeyConfirmation model provides a boolean
indicating whether a particular instance has expired. The expiration
is based on a settings value which can be reconfigured.
Ignore expired confirmation keys in the confirmation view

The view should ignore confirmation keys which have expired without
changing the public key to active.
Implement a task to send confirmation emails for new PKs

When a new PK is created, this task should be initiated asynchronously
in order to create the confirmation key and send an email asking the
user to confirm it.
Implement a hook on PublicKey creation to start the confirmation task
Make the ``active`` field of public keys read only

Keeping it writable for the purposes of testing is too dangerous.

An alternative to ease creating public keys during testing without
need to confirm them is to set the setting
``TCA_ENABLE_EMAIL_CONFIRMATIONS`` to ``False`` and keep ``DEBUG``
``False`` too.
Make DEBUG default to False in production settings

It is dangerous to keep the template file for production settings
without explicitly specifying that DEBUG needs to be False.