Add support for a new /build API

[calebhailey]

Add support for a new /build API which can be called from CI after successful builds, thereby eliminating the various race conditions resulting from our current dependency on GitHub Webhooks.

Requires should require a GitHub token be provided as a HTTP Header w/ requests to the /build API, then use this token to verify that the requester is authorized to request an asset build (see "List repositories for the authorized user").

Notes:

• TBD what "affiliation" or "type" values indicate authorization to request an asset build (see "List repositories for the authorized user").

[calebhailey]

Related (but out of scope for this issue): #336

[jspaleta]

Straw implementation

1. User sends github personal access token to bonsai build

2. Bonsai finds user login name for access token using github api endput /user
   Ex:

curl   -H "Accept: application/vnd.github.v3+json"   -H "Authorization: token ${GITHUB_TOKEN}" https://api.github.com/user
{
  "login": "jspaleta",
  ...
}

3. Bonsai determines if user connected with access token is a collaborator on a repo /repos/{owner}/{repo}/collaborators/{username}
   return status 204 indicates user is a collaborator

curl   -H "Accept: application/vnd.github.v3+json"   -H "Authorization: token ${GITHUB_TOKEN}"  -s -o /dev/null -w "%{http_code}"  https://api.github.com/repos/sensu/sensu-go-workshop/collaborators/jspaleta
204

4. Use personal access token with github api releases endpoint to pull github release assets as needed.

Note: this should work with both public and private repositories if personal access token is given repo scope.

[calebhailey]

Closed via #337