Add persistent per-item access tokens that can be used in QR codes

[ml-evs]

This PR initiates the work on allowing QR codes to be generated that are
accessible by anyone who has printed one out, requested by @PeterKraus in #1053.

It does this by adding a /items/<refcode>/issue-access-token endpoint, which stores a token in the
database that can be used to access that refcode without login. A corresponding
admin endpoint for invalidating the token is added, in case of nefarious use.

Outstanding questions:

• For the UI, this should likely be a conscious second step -- e.g., QR code -> generate public QR code. We may want to limit how many there are per item too, perhaps to 1. Admins should probably also have access to another UI that shows when tokens were generated, with the option to invalidate them, though I
  think this could be a future PR.
• Right now, a user with existing access to a sample could generate access tokens to all samples they have access to without using the UI. This is a bit of a harder problem to solve, and involves some trust on existing verified users. For now, the token is stored with the user account in place, so tokens can be invalidated programmatically that correspond to that user. We may also want to investigate a way of sharing a secret between the app and API so that the API can be sure that the generation is being done from a known UI, though this would probably be a relatively complicated deployment detail to implement.
• As it stands in this PR, the user still has to be logged in to get access to the item (though they don't necessarily need to have permissions for it). I will relax this constraint once the rest is properly tested.
• I am currently using uuid.uuid1() for the token generatiion (and storing a sha-512 hash of it in the database), but we might need to reduce the entropy a bit so that it fits into a printable QR.

[cypress]

datalab    Run #3840

Run Properties:   Passed #3840  •  28c59edb9d ℹ️: Merge 920beb16e704ba68735461b564750ecc4e48cecb into e5a78e7ec96ceb1fd6a38d5106eb...

Project	datalab
Branch Review	ml-evs/add-access-tokens-to-qr-codes
Run status	Passed #3840
Run duration	07m 06s
Commit	28c59edb9d ℹ️: Merge 920beb16e704ba68735461b564750ecc4e48cecb into e5a78e7ec96ceb1fd6a38d5106eb...
Committer	Matthew Evans
View all properties for this run ↗︎

---

Test results
Failures	0
Flaky	0
Pending	0
Skipped	0
Passing	336
View all changes introduced in this branch ↗︎

[PeterKraus]

As discussed, feel free to deploy and ping me once it's ready for testing. When QR codes are printed on curvy/flexible surfaces, they're harder to read - I can test how small we can print the QR code to still be useful.