Add support for API keys

[steiza]

#994

This lets users provision an API key, and then use that API key with
forklift.legacy.file_upload. It uses macaroons so advanced users can
further restrict usage of their API key.

This work was originally started at https://github.com/lukesneeringer/warehouse/tree/tokens at the 2018 US PyCon.

It adds a section on /manage/accounts where you can create a new token:

Then a splash shows up with your new API key (note that this key is just on my local dev instance, not a real production key):

And the key is listed on /manage/accounts:

You can then use the key with something like:

curl -X POST "http://127.0.0.1/legacy/?:action=file_upload&version=0.1&name=<package name>&account_token=<key from splash>

Macaroons allow you to further reduce the scope of the API key. For example:

>>> from pymacaroons import Macaroon
>>> macaroon = Macaroon.deserialize('MDAxNmxvY2F0aW9uIHB5cGkub3JnCjAwMjdpZGVudGlmaWVyICJhIHB1YmxpYyB0b2tlbiBhcGkgaWQiCjAwMzFjaWQgaWQ6IGE2YmQ3N2NiLWIzY2QtNDcwNS05N2JkLWEwMzZlMWZjYTkyMQowMDJmc2lnbmF0dXJlIIqV_7ozeE7EXj_xdacB_zUkUJTOT3l9wgjNfSWMuDurCg')
>>> macaroon.add_first_party_caveat("package: exampleproject")
<pymacaroons.macaroon.Macaroon object at 0x103f24630>
>>> macaroon.serialize()
'MDAxNmxvY2F0aW9uIHB5cGkub3JnCjAwMjdpZGVudGlmaWVyICJhIHB1YmxpYyB0b2tlbiBhcGkgaWQiCjAwMzFjaWQgaWQ6IGE2YmQ3N2NiLWIzY2QtNDcwNS05N2JkLWEwMzZlMWZjYTkyMQowMDIwY2lkIHBhY2thZ2U6IGV4YW1wbGVwcm9qZWN0CjAwMmZzaWduYXR1cmUgksBAiGLCnUJxORDKDc-XV0ZkrKGG3yglj0WYR8OazVEK'

... and then the key is scoped to uploading just that package.

There's many places this pull could go from here. There should probably be additional testing, particularly off the happy path. We could add a first party caveat to support the key expiring after a certain date. Make instead of package it should be packages so you can support restricting it to a set of packages? You wouldn't want to support multiple package caveats on a Macaroon - otherwise someone who gets your Macaroon could just add another package, defeating your earlier restriction!

Feedback welcome!

[dstufft]

I just want to let you know, I plan on looking at this later this week.

[steiza]

Thanks! I finally figured out how to run the linter locally. I'll look at the coverage issues in the meantime.

[steiza]

I accidentally hosed this branch when trying to update it / resolve merge conflicts last night. See instead #4949.