CRUD for API tokens in Web UI

[evanp]

A lot of services that support sophisticated users have an interface for creating "personal API tokens" or "personal API keys". We should let users create their own OAuth 2.0 bearer tokens which they can plug into apps, command-line tools, or just curl in order to use the API.

We should have a way to:

• list your existing bearer tokens
• create a new bearer token with an (optional?) mnemonic comment ("my image uploads")
• delete a bearer token

The systems I've used, like Gitlab, Github, or Digital Ocean, only show the full token to the user at creation time, with a warning like "copy this and write it down somewhere, because this is the last time you're going to see it in this UI." I think if we do that, we'd require a comment, so people could track the token.

I've seen these managed separately from "application authorizations" in the systems I've used, but we probably also need a way to view and delete those, too.