Allow shops to issue and use API keys for endpoints

[zenweasel]

Reason: The "authenticate and then use token" is fine for browsers but for external systems it's clumsy.

Users should be able to issue an API (created by the system), and add permissions like they would a normal user. They should also be able to remove and disable them.

The system should they take in the API key and use it instead of a token to allow access to endpoints.

Beyond the scope of this but there should be some hooks built in if people want to rate limit people. (e.g. we increment a counter per api key somewhere)

This should really be associated with the Bulk Import/Export API work