3rd-party App Auth

Adds authorization for 3rd-party applications.

Notes:

 - Once we're happy with this, `./src/lib/ssb-client.js` should be moved into its own repo and package
 - The auth relies on the origin header (eg CORS) which currently fits with our security-model, which does not try to stop local non-browser programs from accessing the server with full perms
 - To test the 3rd party auth, run `npm run tests-host` and open `http://localhost:8000/app-auth.html`. To build the tests, run `npm run build-tests`.