api: Test VM login scopes.

The virtual machine controller is the only one doing anything
interesting with API token scopes right now.  I'm writing this test
for that functionality to make sure it stays effective through
refactoring.
api: Introduce path-based API token scopes.

Refs #1904, #2662 for background discussion.
api: Migrate VM auth scopes to new system.

VirtualMachinesController was the only one doing anything special with
API token scopes before we provided the more general-purpose system.
This commit removes its specialized code, and provides a database
migration to convert those specialized scopes to the general-purpose
schema.
api: Support scope searching in API token index.
api: Support filters in API client auths index.

Per comments on Refs #1904.  filters is generally the preferred way to
do searching now.  I maintained existing limits on what can be
searched with this method.
Merge branch '1904-object-scopes'

Closes #2642, #2662, #2682.